Question

I have a php function that’s run when a build.php page is loaded and creates a $variable. I have save.php also, which is called via an ajax function in scripts.js (taking data sent through POST), but I need to use $variable in save.php.

Is there a good way to send further data through ajax without it being visible on the front end?

I thought of using a $_SESSION variable for this, which seems like it would work, but I understand it may not be totally reliable and is not always a good idea (though this might have been overstated where I was looking).

Is that the best way? Or is there some other way to get a PHP variable to another one via javascript without it being in the front end code?

Answer 1

Session variables exist only on the server, not on the client. For you to save a session variable that was originated by your javascript function in the browser you will need to pass it to the server somehow. And as you probably realize you don’t have much control on what happens on the client side. They can pretty much change any post information you send over to the server – there are some programs that do that fairly easily.

Even if you use ajax, the client can still mess with your variables.

You could try to encrypt the information before sending it.

If in the other hand you want to pass variables between two scripts running on the server you can definitively do that using session variables.

Update

It seems that you are creating the variable in your first script and then there is a javascript function that calls the second script and you need the second script to access the variable created by the first script.

In the above scenario you can definitively use session variables. This is the main reason they exist. To allow you to pass information among different scripts.

First PHP script

session_start();
logic to create the variable
$_SESSION['myVar'] = $myVar;
rest of the script

Javascript

calls second script / does not change the value of the variable

Second PHP script

session_start();
$myVar = $_SESSION['myVar'];
execute second script

I hope this makes sense.