Trouble accessing Drupal $_SESSION variable from external page - php

Question

I'm having trouble accessing a $_SESSION variable on an external page.
Basically, I have a form on a drupal node, which when submitted, POSTS to an external php file which saves the value to a $_SESSION variable like so:
//Bootstrap Drupal so we can use the SESSION variables, where we store the calling number for the
//duration of the logged in session
define('DRUPAL_ROOT', $_SERVER['DOCUMENT_ROOT']);
$base_url = 'http://'.$_SERVER['HTTP_HOST'];
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_SESSION);
//Save number as the calling number for the session
$_SESSION['calling-number']=$_REQUEST['calling-number'];
That works fine.
When I later try and access the $_SESSION variable from an external page using:
//Bootstrap Drupal so we can use the SESSION variables, where we store the calling number for the
//duration of the logged in session
define('DRUPAL_ROOT', $_SERVER['DOCUMENT_ROOT']);
$base_url = 'http://'.$_SERVER['HTTP_HOST'];
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_SESSION);
echo $_SESSION['calling-number'];
I get nothing. If I look at the $user on this new page, I can see that it is because it is running under an anonymous user session (uid = 0), instead of the logged in user ID which set the $_SESSION variable, and thus it can't find it.
Any ideas why I'm not using the session of the logged in user?
EDIT
Not sure why this is, but as long as the two external files are in different directories, this works fine. If they are in the same directory, it seems to start a new session and not access the existing one. No idea why though.

Answer 1

If I understand correctly, you submit a form from Drupal, where there is an authenticated user, to an external PHP file. When you try accessing the session from an external page, which bootstraps Drupal, the session doesn't contain the previously saved value, and the user is reported to be an anonymous user, and not the authenticated user who previously committed the form.
This normally happens because:
Drupal doesn't find the cookies whose names are session_name(), and substr(session_name(), 1).
In this case, drupal_session_initialize() executes the following code.
// Set a session identifier for this request. This is necessary because
// we lazily start sessions at the end of this request, and some
// processes (like drupal_get_token()) needs to know the future
// session ID in advance.
$GLOBALS['lazy_session'] = TRUE;
$user = drupal_anonymous_user();
// Less random sessions (which are much faster to generate) are used for
// anonymous users than are generated in drupal_session_regenerate() when
// a user becomes authenticated.
session_id(drupal_hash_base64(uniqid(mt_rand(), TRUE)));
if ($is_https && variable_get('https', FALSE)) {
$insecure_session_name = substr(session_name(), 1);
$session_id = drupal_hash_base64(uniqid(mt_rand(), TRUE));
$_COOKIE[$insecure_session_name] = $session_id;
}
Drupal doesn't find a record in its sessions database table for a sid (or ssid) equal to the value of the $sid argument passed to its session read callback (_drupal_session_read()). This could also happen if the session has expired.
if ($is_https) {
$user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.ssid = :ssid", array(':ssid' => $sid))->fetchObject();
if (!$user) {
if (isset($_COOKIE[$insecure_session_name])) {
$user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = :sid AND s.uid = 0", array(
':sid' => $_COOKIE[$insecure_session_name],
))
->fetchObject();
}
}
}
else {
$user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = :sid", array(':sid' => $sid))->fetchObject();
}
Drupal always save the session for the current user when PHP shutdowns, through _drupal_session_write(). It is done also when the current user is an anonymous user.
if (!drupal_save_session()) {
// We don't have anything to do if we are not allowed to save the session.
return;
}
// Check whether $_SESSION has been changed in this request.
$last_read = &drupal_static('drupal_session_last_read');
$is_changed = !isset($last_read) || $last_read['sid'] != $sid || $last_read['value'] !== $value;
// For performance reasons, do not update the sessions table, unless
// $_SESSION has changed or more than 180 has passed since the last update.
if ($is_changed || !isset($user->timestamp) || REQUEST_TIME - $user->timestamp > variable_get('session_write_interval', 180)) {
// Either ssid or sid or both will be added from $key below.
$fields = array(
'uid' => $user->uid,
'cache' => isset($user->cache) ? $user->cache : 0,
'hostname' => ip_address(),
'session' => $value,
'timestamp' => REQUEST_TIME,
);
// Use the session ID as 'sid' and an empty string as 'ssid' by default.
// _drupal_session_read() does not allow empty strings so that's a safe
// default.
$key = array(
'sid' => $sid,
'ssid' => '',
);
// ...
db_merge('sessions')
->key($key)
->fields($fields)
->execute();
}

Answer 2

For those who have the same problem when using an external page:
You just have to put some more parameters to the code
In fact, you have to precise your drupal directory.
Ex. for a page which is in the directory before your drupal directory
// Definine the path to "DRUPAL_ROOT" which is used throughout bootstrap.inc
define('DRUPAL_ROOT', getcwd() . '/your_drupal_directory');
// you could write like this too
// define('DRUPAL_ROOT', $_SERVER['DOCUMENT_ROOT'] . '/your_drupal_directory');
// Define the $base_url which will be used by Drupal to make sure we are on the same domain
$base_url = 'http://'.$_SERVER['HTTP_HOST']. '/your_drupal_directory';
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_SESSION);
echo $_SESSION['calling-number'];