Question

I had my form processes working perfectly but after renaming the form action to

<form action="https://www.example.com/validate.php" method="post">

for working with an SSL certificate it stopped working. Seems as though the SESSION variables are no longer being passed properly…

Is there something I should know about https and forms?
If I keep the form action path relative it works fine but will my form be secure?

Answer 1

1. Debug whether cookies send to HTTP
   site is also sent to HTTPS site or
   not.
2. Is your HTTPS server able to be
   loaded at the first place? Maybe the
   configuration is not right or
   something.
3. If it is relatively path, it will not be secured, since your page is not secured.
4. You can try loading the page with this form on the secure HTTPS server, and do the postback. (i.e. secure -> secure)

Next, you might want to pass your Session ID of the non-secure page to the secure page.

e.g. at Form page:

<form action="https://www.example.com/validate.php" method="post">
<input type="hidden" value="<?php echo session_id(); ?>" name="sid" />

at postback page:

session_id($_POST['sid']);

you should be able to reconnect to the session. hope it helps.