Post data to URL and include session data

Question

In writing a test for a php script, I want to send the tested script post data and also have it receive the $_SESSION data from the sending php test script.

Peter and Burak both showed a way to send the post data in POST data to a URL in PHP One used curl and the other html5.

Using either of the two solutions, I get the $_POST data in the tested script, but not the $_SESSION data from the sending php script.

I have tried dozens of suggestions found online, but I never get the session data using those suggestions.

Help would be appreciated.

At which point do you set session data? – MegaAppBear Feb 28 '15 at 15:55 — MegaAppBear, Feb 28 '15 at 15:55
See comments and code under the answer below. – JimFuqua Mar 01 '15 at 21:59 — JimFuqua, Mar 01 '15 at 21:59

score 0 · Answer 1 · answered Feb 28 '15 at 15:22

0

$_SESSION data is created on the server, there is no way for a client to send $_SESSION data.

answered Feb 28 '15 at 15:22

Rain

96
11

The PHP test script and the tested script are both on the server. No client is involved. I want the test script to simulate the input from the client. I can do that exclusively with post data, but I have been using PHP and session variables to alter the lessons while on the server and before delivery to the student-client. I would like to avoid ever sending some of that data to the client. That is why I want to use session variables. – JimFuqua Mar 01 '15 at 18:32
TO LLL: My code is essentially identical to that of Peter and Burak in the link in the question with the exception of setting the session variables. I did try killing the session and restarting it in the test script. I also succeeded in transferring the session variables by both methods in the example script, but when I did that I did not get the post variables. – JimFuqua Mar 01 '15 at 18:50
TO amrhady: I set the session data in the test script and var_dumped both the $_SESSION and $_POST arrays in the tested script. I get one or the other, but never both. The secret must be in the settings in cURL or in the HTML 5 stream_context_create. Both methods work, but when I tinker with the settings I either lose the $_POST array or the $_SESSIONS array. Obviously I don't know how either works theoretically and am just doing blind tinkering with the settings. – JimFuqua Mar 01 '15 at 18:51
TO LLL: I don't know how to post the code using these comments because of the size limitation. I will try to simplify my code to the bare minimum and post them on my website with a link in a new comment when that is done. The answer must be in the way they are sent to the tested script. Send one way and the post data gets there. Send another way and only the session data gets there. It must be in the settings. – JimFuqua Mar 01 '15 at 19:07
The code is posted at http://jim-fuqua.com/tests/ the extensions have been changed from .PHP to .txt so they will display and not execute. The are set up to run under localhost after the extensions are changed back to PHP. – JimFuqua Mar 01 '15 at 21:56
Although your code (sender and receiver) are on the same server, but you simulated a browser in your sender code. That mean, when receiver receive your POST data, it has a session id which is different to the sender session id. That is the reason why you lost your $_SESSION in receiver – Rain Mar 02 '15 at 02:45

score 0 · Answer 2 · edited Aug 13 '16 at 17:38

The answer is simple although it may create performance issues and even clues that you would not want to give to a hacker in a production environment. I was using it for testing and debugging on a single machine.

The answer is to place a script link on the client page as follows:

 <script><?php require 'scripts/clockwise_counterclockwise.js.php';?></script>

This alters the js being inserted into the client page to include server side variables. The client gets the server variables as js variables. As the js is altered by PHP before it is sent to the client it can contain whatever server side variables you want to include and can return the variables in post variables.

Whether this would be problematic in a production environment is irrelevant. Whether it is necessary for debugging is also another matter.

I was just trying to verify that a lesson sent to a particular student in a particular session was being processed and answered by the correct student and attributed to the correct student in the db during the same session.

Jim Fuqua

Post data to URL and include session data

2 Answers2