How to use $_GET?

Question

I have the following login script, where i do use sessions.

<?php
session_start();
if(isset($_SESSION['logged_in'])){
    $id = $_SESSION['id'];
    header("Location: start.php?id=$id");
    exit();
}

if(isset($_POST['submit'])){

    $x1 = $_POST['x1'];
    $x2 = $_POST['x2'];
...
$query = $db->query("SELECT * FROM table WHERE x1='".$x1."' AND x2='".$x2."'");
        if($query->num_rows === 1){

            $row = $query->fetch_object();
            $id = $row->id;

                        $_SESSION['logged_in'] = true;
            $_SESSION['id'] = $id;
            header("Location: start.php?id=$id");

                        3more queries
                        exit();

start.php will be just:

<?php
echo $_GET['id'];
?>

I thought $_GET['id'] would be stored on the server so that $_GET should be displayed. The fetch_object is working. I know that, because it will be displayed the right way at "id=$id" at the browser. So would someone be that friendly and could help me out. Thanks!

Solution 1

The $_GET superglobal is defined as part of the URL string:

http://example.org/index.php?foo=bar&baz=1

In index.php:

echo $_GET['foo']; // bar
echo $_GET['baz']; // 1

So $_GET is not stored on the server, but is passed with each HTTP request, as is $_POST, but that is passed in the HTTP headers rather than simply appened to the end of the URL.

Solution 2

$_GET variables are those passed via the URL, i.e. index.php?foo=bar&baz=qux (foo equals bar, baz equals qux).

These variables are not stored on the server as a part of the session, but rather only exist with that request. If you want to store information on the server as a part of the session, you should use $_SESSION instead, which will exist within the current session, regardless of the request.

Comments

[John]

hello and thanks for answering, that i do understand. when the $_GET will be passed over the url, start.php should be able to read it out or not? why does the echo phrase wont display the id, when it is stored in the url?

[Neil Alexander]

If you pass it through the URL to start.php in your redirect (as it looks like you are trying to do), then yes it will be readable, otherwise not. I think it does not really help to pass the session ID through a $_GET variable though seeing as you have already saved it into $_SESSION.

[Karthik Kumar Viswanathan]

Even $_POST isn't stored. Very ambiguous quote.

[kingcoyote]

Did you just look through my recent stuff to find something to (incorrectly) criticize because I pointed out how retarded your 4 deep nested ifs was? I never said POST is stored. In fact, I explicitly said POST is sent in the same way as GET, with each HTTP request.

[Karthik Kumar Viswanathan]

Hmm? I just found the answer to be vague. Please correct it, whoever you are.

[kingcoyote]

Since my original reply was deleted, I'll repost it more nicely - it's not vague. It's very clear. And you shouldn't go hunt for 3 month old posts to criticize when someone disagrees with your answer as being inefficient and bad practice.