php session variable getting lots

[xoggoth]

Am using freeware php Captcha code supplied by the hosters on email and order forms. It works fine with IE but not with other browsers. This is the commonly used Simon Jarvis script and I am sure if there was a general problem like this there would be some references on the net but can't find any, so it has to be something in my setup.

<form action="captcha/formnewf.php" method="post">
.....
<img src="http://xxx.co.uk/captcha/CaptchaSecurityImages.php?width=140&height=40&char acters=8"><br>
<input id="security_code" name="security_code" type="text"><br>
<input type="submit" name="submit" value="Send message">
</form>

CaptchaSecurityImages.php has the line:
$_SESSION['security_code'] = $code;

formnewfa.php has the line
if( $_SESSION['security_code'] == $_POST['security_code'] etc

In IE $_SESSION['security_code'] has the expected value, in Firefox and Chrome it is empty.

Any ideas why my session variable is getting lost? Cheers for usual brill solutions.


PS The usage is all in accordance with instructions here
PHP Captcha Security

PPS Found others with same problem but no answers. Cookies are enabled and I disabled Firebug and other addins.

[NickFitz]

Assuming you're on Windows (on the client side), download Fiddler and see what the HTTP traffic is both when requesting the page containing the form and when submitting it with IE. Then do the same with FF and Chrome and see if you can identify any differences.

The PHP session ID should be in a cookie, so you want to take note of the Set-Cookie header sent to you when you load the page containing the form, and the Cookie header sent back when you submit the form. If the Set-Cookie header is being sent to IE but not to the other browsers then there's probably some kind of broken browser-sniffing on the server. If the Set-Cookie header is going to all browsers but only IE is sending it back then it seems likely that some setting in the other browsers is preventing the session cookie from being returned.

EDIT: the easiest way to configure Firefox to use Fiddler is with the FiddlerHook extension, which should be installed along with Fiddler - here's the documentation. You might have to restart Firefox to get it to recognise it. Chrome should use it automatically while it's active.

[xoggoth]

Thanks Nick bit that tool looks useful for future but just dropped back to say I'd sorted it.

If replace
<form action="captcha/formnewf.php" method="post">

by
<form action="http://gatekeeperel.co.uk/captcha/formnewf.php" method="post">

it works. In firefox anyway. Yet to check others. Had similar path errors before, like using \ works instead of / in IE not in most others.