Do you have a question? Post it now! No Registration Necessary. Now with pictures!
- Posted on
- PHP Session Trouble on Multiple Include
- Sean Pinto
November 2, 2004, 11:00 pm
rate this thread
kinda complicated to explain. I am implementing a company management
suite that requires Role-Based authentiations (ie. users are in groups
and groups have roles). I have one script which is included in EVERY
page in the protected area (masterFuncs.php) and it contains function
declarations as well as the authentication module kick-off. Here is a
snippet from masterFuncs
$rAuth = new RoleAuth();
if( isset($_GET['logout']) && TRUE == $_GET['logout'] )
Have Been Logged Out"));
if( count($mustHaveRoles) > 0 )
//User is required to have ALL roles
if( count($atLeastRoles) > 0 )
//User is required to have 1 role
Then when I want to restrict a page to a subset of my users i put at
Deeply seeded within the requireAtLeast() and requireRole() methods is
a session_start(). The problem arises when a script has
$mustHaveRoles or $atLeastRoles set and then after the return of the
include masterFuncs.php and the roles have been validated the script
may "include" another page that may have different role requirements
set and reincludes masterFuncs.php to verify them. When it gets to
the session_start() there is no session data set and it wants you to
As a weird twist, if i substitute require_once or include_once for the
include directive everything works...however i don't think that the
second role requirements are enforced because it does not re-evaluate
the script. Ideas??
Thanks in advance,
Re: PHP Session Trouble on Multiple Include
First, regarding the require / include _once.
this variant is intended to prevent the same file being included more then
once. If any of the code in an included file would overwrite a previous
function or define declaration the system throws a fatal error. your best
bet would be to pull the system start out and put it in a place where it is
included exactly once for each run in all cases.
Second Session Variables
Note that session variable handling is affected by the register globals
setting session variable type (server/cookies etc and also by PHP version.
check the manual for differences.
I use a 4.3.x server with globals off. the recommended construct for this is
$_SESSION['varname'] I test for the presence of my session variable and if
not found prime it.
thereafter until the end of the session (session_destroy()) or close of
browser it is always there..
For reliability I always set the variable initially before headers are sent,
in fact if you can process your session variables before sending headers you
get around lots of behavioural differences between implementations,
To make handling easy, remember that (with session files anyway- others
untested) you can make your session variable into a multidimensional array,
so testing for the base name is sufficient for crude tests, followed by
detailed examination/setting of the array elements for fine control.