Re: [PHP-DEV] Re: PHP 4.0 Bug #8073 Updated: MS Internet Explorer 5, Post Method(forms) and session_start() From: chrisv <email protected>
Date: 12/05/00

> Dear sirs:
>
> I appreciate and understand your answer but I insist this is a bug:
> If this is not a bug, there is a big inconsistency: why when I Use the GET
> method in a form, with the session.cache_limiter (php.ini) set to "nocache",
> I'm allowed to go back and forth through the executed pages with no problem?
> (I mean, according to your answer, the GET method in a form overrides the
> nocache option in the session.cache_limiter changing it to "public" or
> "private".

The nocache option overrides the GET method, but since all of the relevant
data is in the URL for doing a GET request, it's not necessary to prompt
the user whether they want to send the data again. The browser simply goes
back to the webserver and sends the appropriate request as it did the
first time.

> I tested the private and public options for the session.cache_limiter and
> got dissapointed with the fact that client users will execute the cached
> versions of the php files even when they press the "refresh" button of their
> browsers. That means that they won't be able to load my newer versions of
> the files. Is this the expected behavior?
> There's got to be a way to use no-cache and the post method without the need
> for those annoying Internet Explorer messages to show up.

The expected behaviour is as you are seeing. Both IE and Netscape will ask
a user if they want to re-post form data if they go back to a page which
was retrived via POST and has nocache set. If public or private is set,
neither browser will ask, they will present the old version of the page.

As for the differences between ASP session handling and PHP session
handling, that is most likely a difference between which PHP sends --
Cache-Control: nocache
Pragma: nocache

whereas IIS sends--
Cache-Control: {private|public}

back to the web browser.

Pages containing results which were retrived via POST should not be
redisplayed immediately anyway -- as IE said it was, it is simply a
security precaution preventing you from sending your data to a place you
didn't want to send it to. If you need to get back to it from page 3 in
your example below, place a link back to it on the page, don't use the
back button.

Chris

> >[2000-12-01 19:24:19] aramirez66 <email protected>
> >It takes the interaction of three web pages for the problem to show up:
> >1) a php file with session_start() and a form (Post Method) pointing
> >(action) to file 2.
> >
> >2) Once the form in file 1 is submitted we get to php file 2. File 2 also
> >uses session_start() and links to file 3.
> >
> >3) we are in file 3 and try to get back to file 2, I get this message from
> >internet explorer instead of file 2.
> >
> >"Warning: Page has Expired The page you requested was created using
> >information you submitted in a form. This page is no longer available. As a
> >security precaution, Internet Explorer does not automatically resubmit your
> >information for you.
> >
> >To resubmit your information and view this Web page, click the Refresh
> >button."
> >
> >
> >This situation does not happen when:
> >1) Use "session_start" and "get method" on file 1)
> >2) use "post method" but do not use "session_start". So it looks like the
> >problem is with the "session_start" function.
> >
> >I replicated the same programs with .asp (microsoft) (e.g. using session
> >handling and post method) and no problem.
> >
> >I hope this helps,
> >
> >Alejandro Ramirez
> >Caracas - Venezuela 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>