How to use $_GET?

Question

I have the following login script, where i do use sessions.

<?php
session_start();
if(isset($_SESSION['logged_in'])){
    $id = $_SESSION['id'];
    header("Location: start.php?id=$id");
    exit();
}

if(isset($_POST['submit'])){

    $x1 = $_POST['x1'];
    $x2 = $_POST['x2'];
...
$query = $db->query("SELECT * FROM table WHERE x1='".$x1."' AND x2='".$x2."'");
        if($query->num_rows === 1){

            $row = $query->fetch_object();
            $id = $row->id;

                        $_SESSION['logged_in'] = true;
            $_SESSION['id'] = $id;
            header("Location: start.php?id=$id");

                        3more queries
                        exit();

start.php will be just:

<?php
echo $_GET['id'];
?>

I thought $_GET['id'] would be stored on the server so that $_GET should be displayed. The fetch_object is working. I know that, because it will be displayed the right way at "id=$id" at the browser. So would someone be that friendly and could help me out. Thanks!

Answer 1

The $_GET superglobal is defined as part of the URL string:

http://example.org/index.php?foo=bar&baz=1

In index.php:

echo $_GET['foo']; // bar
echo $_GET['baz']; // 1

So $_GET is not stored on the server, but is passed with each HTTP request, as is $_POST, but that is passed in the HTTP headers rather than simply appened to the end of the URL.

Answer 2

$_GET variables are those passed via the URL, i.e. index.php?foo=bar&baz=qux (foo equals bar, baz equals qux).

These variables are not stored on the server as a part of the session, but rather only exist with that request. If you want to store information on the server as a part of the session, you should use $_SESSION instead, which will exist within the current session, regardless of the request.