Re: Yet Another "session_start() Cannot send session cache limiter - headers already sent" Question



On Mar 30, 9:27 pm, "three-eight-hotel" <t...@xxxxxxxxxxxxxxxxxxxx>
wrote:
I'm somewhat of a newbie to PHP coding, but have developed a site
using the technology, and have been pleasantly surprised by the
capabilities offered. I am more comfortable in the ASP world, however
and am really struggling with managing sessions in PHP, based on my
experiences with managing sessions in ASP.

99.9% of the feedback I have seen when dealing with the errors has
referred to having whitespace before the <?php or after the ?>. I
have opened my source in several different editors and can't find that
to be the case with my code. Aside from having general issues with
the basic methodology in which I am managing sessions, I am completely
perplexed as to why I am getting these errors, from time to time...

For those who might have recommendations on an overall session
management strategy, I basically want to allow my user to come into my
site, through any page that might be bookmarked. Not all pages are
going to require a session, but they may be required to have a session
value set in order to perform certain administrative functions (which
requires a successful login), so I would need to check for the
existence of a session value and log them in and set it, if it doesn't
exist...

Now to my specific problem...

I have an include page called master_session.php, which looks like
this (no whitespaces before or after php tags):
=================================
<?php
if (! isset($ADMIN_session)) {
ob_start();
ob_clean();
session_start();
session_register("ADMIN_session");
}
?>
=================================

I have a login page, which looks like this (no whitespace before the
include of master_session)
=================================
<?php require_once($_SERVER['DOCUMENT_ROOT'].'/common/includes/
master_session.php'); ?>
<?php if ($content_identifier == false){
$content_identifier = 'parish';}?>
<? $page_title = "Administration"; ?>
<?php require_once($_SERVER['DOCUMENT_ROOT'].'/common/includes/
master_header.php'); ?>
<?php require_once($_SERVER['DOCUMENT_ROOT'].'/common/includes/
master_nav.php'); ?>
<?php require_once($_SERVER['DOCUMENT_ROOT'].'/common/includes/
bg100.php'); ?>
<!----CONTENT AREA -- PLACE INCLUDE PATH AND FILE NAME BELOW---->
<form name="criteria_form" action="adminvalidation.php" method="post">
<table height="100%" border="0" width="81%" align="center"
background="/common/bkgrnds/bg100.gif"">
<tr>
<td colspan="2" height="40">&nbsp;</td>
</tr>
<? if (${"login"} == "invalid")
echo "The username/password you have entered is invalid, or you do
not have privileges to perform administrative functions. If you feel
you've received this message in error, please contact your system
administrator.";
?>
<tr>
<td colspan="2" align="center"><strong>Please Login</strong></
td>
</tr>
<tr>
<td colspan="2" height="40">&nbsp;</td>
</tr>
<tr>
<td align="right">Username&nbsp;</td>
<td><input type="text" name="user_nm" size="8" maxlength="8">
</td>
</tr>
<tr>
<td align="right">Password&nbsp;</td>
<td><input type="password" name="password" size="10"
maxlength="10">
</td>
</tr>
<tr>
<td colspan="2" height="40">&nbsp;</td>
</tr>
<tr>
<td colspan="2" align="center"><input type="submit"
name="Submit" value="Submit">
</td>
</tr>
<tr>
<td><input type="hidden" name="content_identifier" value="<?echo
${content_identifier}?>"></td>
</tr>
</table>
</form>
<!----END CONTENT AREA --- NO CHANGES BELOW THIS LINE-------->
<?php require_once($_SERVER['DOCUMENT_ROOT'].'/common/includes/
master_footer.php'); ?>
==============================================

master_header.php is where my HTML code starts:
========================
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

etc...................
========================

Is there anything in here that jumps out at anyone, as to why I'm
getting the error? The exact error is:

Warning: session_start() [function.session-start]: Cannot send session
cache limiter - headers already sent (output started at /home/holytrin/
public_html/common/admin/admin.php:2) in /home/holytrin/public_html/
common/includes/master_session.php on line 4

btw.. I do an ob_end_flush() in the master_footer.php file, on the
very last line...

Any help would be greatly appreciated!!!

Best Regards,
Todd

btw, am I to assume you are using ob_start being you are implementing
some kind of compression - if not, then don't bother using it.
Also convert all short tags <? to <?php which is the standard these
days, and will make your scripts easier to port onwards, and when you
finally turn off short tags in the php.ini (or upgrade) you will be
able to use <?xml style declarations without conflicts.
Also I assume you understand about turning globals off, it's just that
if you don't asking questions like
if( $content_identifier == false )
can get you into trouble because later you print that value out (which
you set to parish but could be overridden to something nasty) in the
markup un-filtered.
I should say that I am not in full possession of the facts so it isn't
intended as a -ve critique, more an observation based on what I can
see.

.



Relevant Pages

  • Re: sharing sessions between php and asp
    ... >> I'm working on a site which contains a lot of legacy ASP VBScript code. ... >> PHP support. ... >> For some parts session variables need to be stored and retrieved, ... > You can write your own session handler in PHP but I believe you need some C ...
    (comp.lang.php)
  • Re: Looking for general advice on security
    ... PHP pages have to be world-readable, ... SSL provides a way for a thief with a browser to communicate with ... cookies because the user can't fake a session with arbitrary contents, ... Try to send a message to the user and see if the mail server ...
    (comp.lang.php)
  • Re: query string passing woes........ help... please....
    ... |> | offer any help other than saying that my validation could be FAR more ... I'm a total newbie at php. ... The easiest way for you would be to make the html form called form.php ... $_SESSION array using the same names. ...
    (alt.php)
  • Re: passing parameters from asp to php
    ... In article, Savut ... Yes that's right session doesn't work. ... >> ASP script as client. ... >> If, however, you want to explicitly redirect the browser to the PHP ...
    (alt.php)
  • Advisory 01/2006: PHP ext/session HTTP Response Splitting Vulnerability
    ... PHP ext/session HTTP Response Splitting Vulnerability ... PHP applications using PHP5's session extension are ...
    (Bugtraq)