Got a question for the PHP gurus

[Trevelyan]

Okay, I'm making an online payment system that spans 4 .php pages.

Here is the breakdown:

1st page: Payment amount, product

2nd page: Personal information (name, address, etc.)

3rd page: Payment information (credit card info)

--> All info is collected and parsed to XML processor

4th page: Displays summary of transaction


So, all of this is happening on a secure server. My question is, what is the best/easiest way to pass the data from one page to another? Should I use $_POST on each page and pass the variables along one-by-one... Cookies and sessions?

Any input would be appreciated.

 

[imported_LoKe]

Pass them one by one with hidden forms. Use $_POST.

 

[tfinch2]

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

 

[clamum]

Originally posted by: tfinch2

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

Yep, I was going to use hidden forms but using a session was just as easy, or easier.

Reference

 

[Trevelyan]

Originally posted by: tfinch2

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

But isn't that exactly what a session does... stores info in a cookie?

 

[Trevelyan]

Originally posted by: clamum

Originally posted by: tfinch2

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

Yep, I was going to use hidden forms but using a session was just as easy, or easier.

Reference

If I pass along information through a $_POST, how secure is it?

Say, for instance, that I pass along the credit card number through a $_POST to the next page, and then pass it through XML... would that be secure or not?

 

[tfinch2]

Originally posted by: Trevelyan

Originally posted by: tfinch2

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

But isn't that exactly what a session does... stores info in a cookie?

Yes, but the Session ID cookie is destroyed as soon as the session is.

 

[tfinch2]

Originally posted by: Trevelyan

Originally posted by: clamum

Originally posted by: tfinch2

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

Yep, I was going to use hidden forms but using a session was just as easy, or easier.

Reference

If I pass along information through a $_POST, how secure is it?

Say, for instance, that I pass along the credit card number through a $_POST to the next page, and then pass it through XML... would that be secure or not?

If you're passing along a CC, make sure you are using SSL.

 

[ymca]

Originally posted by: tfinch2

Originally posted by: Trevelyan

Originally posted by: tfinch2

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

But isn't that exactly what a session does... stores info in a cookie?

Yes, but the cookie is destroyed as soon as the session is.

I think session data is stored on server. Client only has a session id.

 

[oog]

Originally posted by: Trevelyan

Originally posted by: tfinch2

Originally posted by: LoKe
Pass them one by one with hidden forms. Use $_POST.

Or just use a session. Don't store their personal info in a cookie.

It's as easy as starting a session at the top of every php file, and using $_SESSION for the variables.

But isn't that exactly what a session does... stores info in a cookie?

Not quite. The cookie identifies a particular session, but the session data is stored only on the server.