Adding a SESSION variable to a url

Question

The users on my website have a home page that has all their details, accessed by the URL below. All the details are gathered with a session variable, so no variables are passed into the URL, but I don't want that.

The URL looks like this

http://localhost/account/users

I want it to look like this

http://localhost/account/users/$_SESSION["username"]

for example

http://localhost/account/users/ethan

I know this can be done using $_GET , but how would I do that with a session variable? The variable in the URL wouldn't do anything it would just be there for looks.

Answer 1

From your question it's not perfectly clear what you want to to, hence I am kind of splitting my answer.

Setting the Session-Variable from URL

As far a I know there is no direct possibility to set session variables from an URL. This would compromise the whole session concept as server-side data, that is only referenced by a session ID.

Say you have a script users.php. You could basically call http://[...]/account/users.php?username=[...] . With the following script you could assign the variable from the $_GET superglobal to the $_SESSION superglobal.

<?php
    session_start();
    $_SESSION['username'] = $_GET['username']
    [...] //whatever you'll want to do
?>

With URL rewrites you could simplify the URL to http://[...]/account/users/[...] .

Anyway, you should make sure that you know what you are doing. I do not see the merits of $_SESSION here, when you pass the username anyway. And you'd possible like to do some input validation. This should not give access to resources that onle the respective youser should have access to.

Just Showing a Users Page

When you'd only want to show a users page you do not really need the $_SESSION superglobal, but only the $_GET in the way I've written above. Consider the following script

<?php
    $user = get_user_by_name($_GET['username']);
    display_user_page($user);
?>

No need for a session. Just load the users data from the db on-the-fly and print out the user page.

Passing the Username to an URL

Based on this quote

The variable in the URL wouldn't do anything it would just be there for looks.

I guess this is rather what you want to do. And how you can achieve this kind of depends.

If you generate the link somewhere in your PHP script this is kind of simple. Just add the $_SESSION['username'] to the URL in the link and create the according rewrite rule, that redirects you to account/users .

It's a bit more complicated when you want to be able to call http://[...]/account/users and move the browser to http://[...]/account/users/username . First of all you'll have to have a rewrite rule that points http://[...]/account/users/username to some sort of http://[...]/account/users.php?username=username . If the username is empty you get the current username from $_SESSION , create a <meta http-equiv="refresh" content="0; URL=http://[...]/account/users/$username"> tag to point the browser to the correct address. If the username is not empty, you just display the users page.

I know this can be done using $_GET, but how would I do that with a session variable?

Since the variable is not used at all, you could actually employ the whole thing without the $_GET at all. You'll have two scripts

// users_redirect.php
<?php
    start_session();
    $username = $_SESSION['username'];
    echo "<meta http-equiv='refresh' content='0; URL=http://[...]/account/users/$username'>";
?>

and the second one to show the users page

<?php
    $user = get_user_by_name($_SESSION['username']);
    display_user_page($user);
?>

Of course you'll have to have the correct URL rewrite rules set up in your server to call the correct scripts.

Just a side note

You should learn the different concepts by heart. GET and SESSION are not only different, but fundamentally different. It seems as if you mixed up quite a lot here and you should get the basics right to not screw things up totally.