As you want to do more in an online application, you need to link a series of forms together. There's a limit to how much you can expect your users to enter on one page, and almost inevitably they'll want feedback as they go through a series of steps. So multiple forms is natural, with each encouraging the user onto the next page by positive responses, and questions on subsequent pages which are tuned based on the answers given on earlier pages.

Unfortunatley, the http protocol that's used by browsers to ask for a page off the server is inherrently stateless - in other words, by default there's nothing that's passed from one page to the next which lets the user identify himself - nothing to say "it's me again" ... so if you're not careful, multiple people who are visiting a website at the same time could get their data mixed up.

There are two good mechanisms which are available for maintaining state via a browser / using http.

1. Hidden Fields. If you're running a series of forms, you can pass out from the server data which is to be returned with the next form when it's submitted via a hidden field.

2. Cookies. If you're outputting content via http (it doesn't have to be a form, and indeed it doesn't even have to be HTML), you can pass out a cookie which will be returned by the browser on subsequent requests to the server.

Cookies have the advantage that they only need to be sent out once, and they are returned on each subsequent page. So they avoid the session being lost if your user breaks away from filling an a chain of forms which would happen with a hidden field. However, cookies are stored by the user's computer / on his browser, and some users have concerns about this - especially as cookies attached to certain images (such as adverts) can be used by the advertising host to learn quite widely about the user's browsing habits.

As you run through a session, you're likely to be entering more and more data ... and if you just used hidden fields or cookies to maintain al that state information, your requsts and responses would grow in size. So it's common practise to use a shopping cart or session scheme.

• when a visitor arrives at your application or website WITHOUT a cookie, you allocate him a unique random code and send that out with your response as (typically) a cookie. You also create a disc file or database record, named or keyed using that unique or random code, and into that record or file you store the information to need to retain about your user

• when a visitor arrives WITH a cookie, you read the data from the disc file or database record that's associated with him, secure in the knowledge that it's his data. You process any new data, and you then store the total information so far, ready for his next visit. In theory, you don't need to send out the cookie again .. in practise you may do so, as cookies have a lifetime after which they are deleted, and you're likely to want to start the clock each time your user visits.

The diagram shows in RED the use of a hidden field alone (with the data getting more and more on each cycle), in BLUE a hidden filed and session, ans in GREEN a cookie and session. Much the most commonly used is the Cookie / Session combination - in fact it's already programmed for you into PHP via the $_SESSION superglobal array and functions like session_start.

We cover maintaining state (and the good practise of how to do it) on both our Learning to program in PHP and PHP Programming courses. We cover it in more depth - including design issues, short and long term state, admin login issues and more on our PHP techniques workshop.

(written 2012-11-10, updated 2012-11-17)

 H301 - PHP - Sticky fields and session
  [1739] Bath, Snake or Nag? - (2008-08-06)
  [1766] Diagrams to show you how - Tomcat, Java, PHP - (2008-08-22)
  [1911] Remember Me - PHP - (2008-11-28)
  [2416] Automating access to a page obscured behind a holding page - (2009-09-23)
  [2738] What is all this SESSION stuff about? (PHP) - (2010-04-25)
  [3540] Easy session example in PHP - keeping each customers data apart - (2011-12-06)
  [3820] PHP sessions - a best practice teaching example - (2012-07-27)
  [4070] Passing variable between PHP pages - hidden fields, cookies and sessions - (2013-04-26)

H112 - PHP - Further Web Page and Network Handling
  [220] When to use Frames - (2005-02-19)
  [314] What language is this written in? - (2005-05-17)
  [345] Spotting a denial of service attack - (2005-06-12)
  [356] Sudoku helper or sudoku cheat - (2005-06-23)
  [372] Time calculation in PHP - (2005-07-08)
  [376] What brings people to my web site? - (2005-07-13)
  [410] Reading a news or blog feed (RSS) in your PHP page - (2005-08-12)
  [425] Caching an XML feed - (2005-08-26)
  [443] Server side scripting of styles to suit the browser - (2005-09-12)
  [451] Accessing a page via POST from within a PHP script - (2005-09-26)
  [484] Setting the file name for a downloaded document - (2005-11-03)
  [537] Daily Image Santafied - (2005-12-22)
  [542] Morning image, afternoon image - (2005-12-26)
  [565] Using PHP to output images, XML, Style sheets, etc - (2006-01-15)
  [603] PHP - setting sort order with an associative array - (2006-02-13)
  [675] Adding PHP tags to an old cgi program - (2006-04-08)
  [767] Finding the language preference of a web site visitor - (2006-06-18)
  [789] Hot answers in PHP - (2006-07-02)
  [847] Image maps for navigation - a straightforward example - (2006-08-28)
  [904] Of course I'll tell you by email - (2006-10-25)
  [936] Global, Superglobal, Session variables - scope and persistance in PHP - (2006-11-21)
  [1009] Passing GET parameters through Apache mod_rewrite - (2006-12-27)
  [1114] PHP Image upload script - (2007-03-21)
  [1183] Improving searches - from OR to AND? - (2007-05-11)
  [1187] Updating a page strictly every minute (PHP, Perl) - (2007-05-14)
  [1210] PHP header() function - uses and new restrictions - (2007-05-30)
  [1355] .php or .html extension? Morally Static Pages - (2007-09-17)
  [1379] Simple page password protection - PHP - (2007-10-04)
  [1485] Copyright and theft of images, bandwidth and members. - (2007-12-26)
  [1495] Single login and single threaded models - Java and PHP - (2008-01-04)
  [1496] PHP / Web 2 logging - (2008-01-06)
  [1505] Script to present commonly used images - PHP - (2008-01-13)
  [1515] Keeping staff up to date on hotel room status - (2008-01-22)
  [1518] Downloading data for use in Excel (from PHP / MySQL) - (2008-01-25)
  [1549] http, https and ajp - comparison and choice - (2008-02-22)
  [2632] Shipping a test harness with your class in PHP - (2010-02-12)
  [2679] How to build a test harness into your PHP - (2010-03-16)
  [2729] Uploading a document or image to its own URL via a browser - (2010-04-18)
  [2918] Downloading a report from the web for further local analysis - (2010-08-13)
  [3036] Sending out an email containing HTML from within a PHP page - (2010-11-07)
  [3432] 3 digit HTTP status codes - what are they, which are most common, which should be a concern? - (2011-09-11)
  [3568] Telling which ServerAlias your visitor used - useful during merging domains - (2012-01-04)
  [4483] Moving from mysql to mysqli - simple worked example - (2015-05-03)

Back to BODMAS - the order a computer evaluates arithmetic expressions

Previous and next or Horse's mouth home

Forward to What is a web framework?

Twerp - A person regarded as insignificant and contemptible
On rememberance, on war, and on preventing the war cycle
Challenge for a photographer
What is a web framework?
Multiple page web applications - maintaining state - PHP
BODMAS - the order a computer evaluates arithmetic expressions
PHP variables - dynamically typed. What does that mean?
How does PHP work?
While, for, foreach or something else to loop.
How many times ... has this loco headed west through Tenby? - Python exceptions