[Javascript] Javascript detection

[Matt Warden]

On 1/2/07, tedd <tedd at sperling.com> wrote:
> But in my defense, I am learning how to pass variables from
> client-side to server-side without using cookies or obvious url's.
> But, to do that I need to know if js is enabled or not. I think I
> have that problem solved.

But this is exactly what you are doing in your js detection scenario.
You are passing a variable to the server side indicating whether js is
available. To make this data usable, you *are* going to have to use
cookies (unless you use PHP's phpsessionid querystring parameter).
Otherwise, the variable will not be available in the $_SESSION. In
other words, you have these options:

1) Store the variable directly in cookies
2) Use PHP sessions, which store a session id in a cookie and persist
the variable on the server side
3) Use PHP sessions, which append a phpsessionid querystring parameter
to every URL and persis the variable on the server side
4) Append the variable as a querystring parameter to every URL

You'll note that 1 and 2 are nearly identical solutions, as are 3 and 4.

Once you establish that JS is available, you could do this
communication via JS alone:

(new Image()).src = "editsession.php?variable=value";

editsession.php is something like:
-----------------
start_session()
foreach ($key in $_GET) {
    if (... do any security validations here...) {
        $_SESSION[$key] = $_GET[$key];
    }
}

For the next request, $_SESSION['variable'] will have value "value".

-- 
Matt Warden
Cleveland, OH, USA
http://mattwarden.com


This email proudly and graciously contributes to entropy.