Using $_POST and $_SESSION - passing variables between pages

Question

I have an index page which gets passed $_POST['timestart'] and $_POST['timeend'] variables. In addition, I have a cart page that has variables passed to it from the index page, and it passes variables back (with header) to the index page depending on what is done. In order to retain the initial $_POST['timestart'] and $_POST['timeend'] variables, I end up storing these variables in a SESSION. My final solution, which works, is something like this.

My index page:

<?php
session_start();
if ($_POST != NULL)
{
 $_SESSION['date'] = $_POST;
 $timestart = new \DateTime($_SESSION['date']['timestart']);
 $timeend = new \DateTime($_SESSION['date']['timeend']);
 $start = $timestart->format('Y-m-d');
 $end = $timeend->format('Y-m-d');
} 
elseif ($_POST == NULL && $_SESSION != NULL)
{
 $timestart = new \DateTime($_SESSION['date']['timestart']);
 $timeend = new \DateTime($_SESSION['date']['timeend']);
 $start = $timestart->format('Y-m-d');
 $end = $timeend->format('Y-m-d');
}
elseif ($_POST == NULL && $_SESSION == NULL)
{
 $start = "";
 $end = "";
}
if ($start == NULL && $end == NULL)
{
 echo 'please select a date range';
}
else
{
....main page....
 <form method="post" action="cart/cart_update.php">
 <input type="hidden" name="model_name" value="<?php echo $item ?>" />
 <input type="hidden" name="type" value="add" />
 <input type="hidden" name="return_url" value="<?php echo $current_url ?>" />
 </form>
}

My cart page (just so it is clear what is happening):

<?php
session_start();
if(isset($_GET["emptycart"]) && $_GET["emptycart"]==1)
{
 $return_url = base64_decode($_GET["return_url"]);
 unset($_SESSION["inventory"]);
 header('Location:'.$return_url);
}
if(isset($_POST["type"]) && $_POST["type"]=='add')
{
 $model_name = filter_var($_POST["model_name"], FILTER_SANITIZE_STRING);
 $qty = filter_var($_POST["qty"], FILTER_SANITIZE_NUMBER_INT);
 $return_url = base64_decode($_POST["return_url"]);
 $new_item = array(array('name'=>$model_name, 'qty'=>$qty));
 $start = $_POST["timestart"];
 $end = $_POST["timeend"];
 if(isset($_SESSION["inventory"]))
 {
 $found = false;
 foreach ($_SESSION["inventory"] as $cart_itm)
 {
 if ($cart_itm["name"] == $model_name)
 {
 $model[] = array('name'=>$cart_itm["name"], 'qty'=>$qty);
 $found = true;
 }
 else
 {
 $model[] = array('name'=>$cart_itm["name"], 'qty'=>$cart_itm["qty"]);
 }
 }
 if($found == false)
 {
 $_SESSION["inventory"] = array_merge($model, $new_item);
 }
 else
 {
 $_SESSION["inventory"] = $model;
 }
 }
 else
 {
 $_SESSION["inventory"] = $new_item;
 }
header('Location:'.$return_url);
}
if(isset($_GET["removep"]) && isset($_GET["return_url"]) && isset($_SESSION["inventory"]))
{
 $model_name = $_GET["removep"];
 $return_url = base64_decode($_GET["return_url"]);
 $model = NULL;
 foreach ($_SESSION["inventory"] as $cart_itm)
 {
 if($cart_itm["name"]!=$model_name)
 {
 $model[] = array('name'=>$cart_itm["name"], 'qty'=>$cart_itm["qty"]);
 }
 $_SESSION["inventory"] = $model;
 }
 header('Location:'.$return_url);
}
?>

My question...for the code I am using in the index page:

if ($_POST != NULL)
{
 $_SESSION['date'] = $_POST;
 $timestart = new \DateTime($_SESSION['date']['timestart']);
 $timeend = new \DateTime($_SESSION['date']['timeend']);
 $start = $timestart->format('Y-m-d');
 $end = $timeend->format('Y-m-d');
} 
elseif ($_POST == NULL && $_SESSION != NULL)
{
 $timestart = new \DateTime($_SESSION['date']['timestart']);
 $timeend = new \DateTime($_SESSION['date']['timeend']);
 $start = $timestart->format('Y-m-d');
 $end = $timeend->format('Y-m-d');
}
elseif ($_POST == NULL && $_SESSION == NULL)
{
 $start = "";
 $end = "";
}

Is this idea a good solution, or is there a better, more elegant way to approach this?

Answer 1

My opinion is that using $_POST == NULL and $_SESSION == NULL is too general and could lead to errors. You should use specific conditions for $_POST["date"] and also validate the data. Plus, I would avoid the repetition in your code by calling a function.

// will return NULL if $dt not valid or empty
function get_valid_date($dt) {
 if (!empty($dt)) {
 try {
 $temp=new \DateTime($dt);
 return $temp->format("Y-m-d");
 }
 catch (Exception $e) {
 return NULL;
 }
 }
 return NULL;
}
// temp store for either $_POST["date"] or $_SESSION["date"] if isset
$date=array();
if (isset($_POST["date"])) {
 $date=$_POST["date"];
} else if (isset($_SESSION["date"])) {
 $date=$_SESSION["date"];
}
// get valid $start/$end date from $date - NULL if not valid or empty
$start = get_valid_date($date["timestart"]);
$end = get_valid_date($date["timeend"]);
// save $date in $_SESSION only if both $start and $end are valid
if (!empty($start) && !empty($end)) {
 $_SESSION["date"]=$date;
} else {
 unset($_SESSION["date"]);
}

• Wes: Thanks! I will be more specific to rule out potential issues as you suggest. Is there anything against using if (isset($_POST['date']) == "true") vs using !empty? Are there any differences between the two?
• verjas: This post has a nice table to explain the difference between isset, empty, and is_null: virendrachandak.com/techtalk/php-isset-vs-empty-vs-is_null Each has it's own use. The biggest difference: if a value is "" (empty string), the isset() will return TRUE, but the !empty() will return FALSE. So, you could also use (!empty($_POST["date"])) to make sure that you exclude cases like: "", 0, "0", FALSE, NULL (but this gets tested in the function) Cheers!