PHP: SESSION partly deleted after header() + exit

Question

I am having some trouble with setting up a pretty small application. It's going to be a little survey.

The form is split into two pages. After submitting the first one, the data is stored in the $_SESSION array with this:

save_items(array('my_data' => $my_data_oject));

The function save_items() looks like this:

function save_items(array $array) {
    foreach ($array as $name => $item) {
        $_SESSION[$name] = $item;
    }
}

Then I unset($_POST) and redirect like this:

header('Location: index.php?action=survey_part2');
exit;

My problem is: After redirection, the previously stored login data is still in the $_SESSION, but my_data_object is not. If I avoid the redirection, I can see that my_data_object is stored in the $_SESSION array before the redirection starts. So the combination of header() and exit seems to destroy the session in part. Does anybody know how this can happen?

Finally, parts of my controller:

<?php
error_reporting(E_ALL);
session_start();

require_once 'models/functions.php';
require_once 'models/classes.php';

$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : NULL;
$view = $action;
$language = isset($_REQUEST['lang']) ? $_REQUEST['lang'] : 'de';

switch ($action) {
    case 'login' :
        if ((!empty($_POST['email'])) && (!empty($_POST['password']))) {
            $user = new User();
            $login = $user->find_user($_POST);
            if (!empty($login)) {
                set_message('Welcome ' . $login['Firstname'] . ' ' . $login['Lastname'] . '!');
                save_items(array('user_id' => $login['CID']));
                unset($_POST);
                redirect("index.php?action=survey&lang=de"); //<- works fine. Login is kept, Message is kept.
            } else {
                set_message('Please try again.');
                unset($_POST);
            }
        } else {
            unset($_POST);
            set_message('Try again.');
        }
    break;

/* ... shortage */
    case 'survey' :
        check_login(); //<- doesn't matter
        if (empty($_POST)) {
            /* ... shortage */
        } else {
            /* ... creation of my_data_object + setting one more message */
            save_items(array('my_data' => $my_data_object));
            unset($_POST);
            save_items(array('test' => 'you see me?')); //<- index.php?action=survey_2 won't get it
            //var_dump($_SESSION);
            header('Location: index.php?action=survey_2&lang=de'); //<- does not work. Login is kept in $_SESSION, but not my_data
            exit;
        }
    break;

Thanks!

This topic is maybe similar to that one here, but my $_SESSION is not empty after header(), but partly deleted.

its `header('Location: index.php?action=survey_part2');` and dont `unset($_POST);` — Lawrence Cherone, May 11 '13 at 16:06
First point is true, I've corrected it. It was already OK in my code. Using unset($_POST) or not does not hava any impact. — BairDev, May 11 '13 at 16:19
Is `session_start();` being called on your page `index.php?action=survey_part2` ? Also, in the end of your "controller" you have `redirect('index.php?aktion=umfrage_2&lang=de');` - shouldn't that be `header('Location: index.php?action=survey_part2');` — Shackrock, May 11 '13 at 19:25
1.: Yes, it is. index.php is my Controller and remains the same, no matter which value 'action' has. 2. redirect() is indeed ambiguous, it is my own function for header('Location: index.php'); exit;. I'll edit that. — BairDev, May 11 '13 at 19:40

score 0 · Answer 1 · edited May 23 '17 at 12:13

Now I catched the problem. I tried to serialize a PDO with save_items() and after 1 day I've found the error message. My hint of the day: if you can, take a look into the php_error_log, because sometimes a very important error message is not shown on screen.

So my issue was relate to that one!

Solution: Put data as an Array into $_SESSION or use __sleep() and __wakeup() to specify which attributes (not: $db = new PDO();) should be serialized and which not.

PHP: SESSION partly deleted after header() + exit

1 Answers1