Re: CURL and $_SESSION problem

From: Pedro Graca (hexkid_at_hotpop.com)
Date: 07/09/04


Date: 9 Jul 2004 00:12:55 GMT

Phil Powell wrote:
> Let's say I have my script at http://www.myphpwebsiteA.com/scrape.php
>
> This script instantiates a Timer class object to do a remote script of
> another site:
>
> http://www.myOTHERphpwebsiteB.com/index.php
>
> Now, my Timer class object does a scrape of "index.php" elsewhere.

I don't do OOP :)
but ok ... your Timer class object has to keep the cookie from index.php

> Two things:
>
> 1) index.php is NOT ON THE SAME SERVER as "scrape.php"

No problem

> 2) index.php MIGHT be $_SESSION-dependent (let's pretend in this case
> that it is)

Again, no problem. The only thing going back and forth between the
server (where index.php is) and the client (your scrape.php script)
needed to keep the session open is the cookie with the session id.

> That means that my scrape.php has to be able to accurately pull up the
> contents of "index.php",

not forgetting the headers,

> on another server, whereby the contents of
> "index.php" are dependent upon an existing $_SESSION variable
> (assuming it had been pre-set somehow).

But this $_SESSION variable in "index.php" is only visible, only
accessible, only known to index.php (or rather the web server).

> Using CURL would be ideal in nearly all cases.. except for the
> $_SESSION variable, because your $PHPSESSID from scrape.php will
> probably NOT match $PHPSESSID from index.php, so doing a "Set-cookie"
> header() will also fail because you're supplying the HTTP headers for
> "index.php" with the wrong $PHPSESSID.

index.php does a setcookie to maintain its session
scrape.php has to get that cookie and send /that same/ cookie to
index.php on subsequent requests.

> You see, to get the right stuff from index.php, understanding the
> autoglobals:
>
> 1) $_GET: You would have to know the $_GET required for "index.php",
> no problem
> 2) $_COOKIE: You would have to know the $_COOKIE variable(s) required
> for "index.php", and if you know it, then set into the HTTP headers,
> again, no problem

How are you doing that?
I just went back to your first post and noticed

    curl_setopt($ch, CURLOPT_HEADER, 0);

The cookie comes from index.php in the headers!

> 3) $_SESSION: You would have to know the $_SESSION variable(s)
> required for "index.php", THAT IS MY PROBLEM!! :(

There you go again :-))

Q. When you go to index.php with the browser, do you (the browser) know
   the $_SESSION variable?

A. No!

Same thing for your scrape.php ... it does *not* need to know the
$_SESSION variable that index.php is using;
It needs to know the cookie that index.php sent in the headers.

-- 
USENET would be a better place if everybody read:   | to email me: use |
http://www.catb.org/~esr/faqs/smart-questions.html  | my name in "To:" |
http://www.netmeister.org/news/learn2quote2.html    | header, textonly |
http://www.expita.com/nomime.html                   | no attachments.  |


Relevant Pages

  • Re: CURL and $_SESSION problem
    ... > This script instantiates a Timer class object to do a remote script of ... your Timer class object has to keep the cookie from index.php ... needed to keep the session open is the cookie with the session id. ... not forgetting the headers, ...
    (alt.php)
  • Re: HELP! Trying to add Email Notification to Download File Code
    ... No need to hard code the script name here! ... cookie - headers already sent by (output started at ... cache limiter - headers already sent (output started at ...
    (comp.lang.php)
  • IE dot bug - Sandblad advisory #7
    ... Initially reported to Microsoft about the dot bug vulnerability. ... Microsoft released patch: ... Files in the cookie directory are not treated as beeing in the ... Remote webpage can script in local zone" ...
    (Bugtraq)
  • Re: Parameter quires in Data access pages
    ... script code from the DAP that writes the cookie to the PC: ... This is the script that reads, writes, and deletes cookies on the PC: ... button on the DAP, and then navigates to the "show me" DAP: ... <MS ACCESS MVP> ...
    (microsoft.public.access.dataaccess.pages)
  • Re: Parameter quires in Data access pages
    ... "Ken Snell (MVP)" wrote: ... script code from the DAP that writes the cookie to the PC: ... This is the script that reads, writes, and deletes cookies on the PC: ...
    (microsoft.public.access.dataaccess.pages)