0

I've setup a session in my custom plugin:

public function initializeSession(): void {
    if (session_id()) {
        return;
    }

    // this is not required, but add it anyway
    session_name('Gym');
    session_start();
    
    if (!isset($_SESSION['cart']) || !$_SESSION['cart'] instanceof Cart) {
        $_SESSION['cart'] = new Cart();
    }
}

At some point an ajax call triggers this function:

public static function getMembership(){
    $locationId = $_POST['locationId'];
    $membershipNameToSearch = $_POST['membershipType'].' '.$_POST['membershipDuration'];
    $membershipRepository = new MembershipRepository(new SportivityClient($locationId));
    $membershipFound = $membershipRepository->findMembershipByName($membershipNameToSearch);
    if($membershipFound == null) wp_send_json([]);
    $_SESSION['cart']->setMembership($membershipFound);
    error_log(json_encode($_SESSION['cart']->getDetails()));
    wp_send_json($_SESSION['cart']->getDetails());
}

When I trigger another ajax call that also uses the cart, but adding something else, an 'Addon' for example. Then it gives me the error Typed property Cart::$membership must not be accessed before initialization Which makes it look like the session is broken somehow. Any ideas why this happening, cause I'm sure the membership has been set inside the cart.

6
  • note that PHP sessions, ignoring their security issues, are disabled on a lot of WP hosts, and incompatible with the majority of caching plugins/systems used in WP sites. As for the typed property error you mentioned, this is probably unrelated to PHP sessions, it sounds like your have a Cart class with a $membership variable that doesn't have a default value assigned, so it's possible to use it before it's first given a value which is not allowed, hence the error. On top of that, you shouldn't be storing objects in $_SESSION, that's a big security/compatibility issue
    – Tom J Nowell
    Dec 14, 2023 at 16:25
  • What else is a good way to store my cart items temporarily?
    – Jan
    Dec 14, 2023 at 16:26
  • it's not that you're storing information in $_SESSION, it's that you're storing objects themselves, this opens you up to object deserialisation attacks amongst other things. You wouldn't store a PHP class object in the database or a file for the same reasons, but you can store JSON/XML/CSV/plain values. You should consider using cookies for carts if user meta isn't an option, especially since PHP sessions require a cookie to be set anyway so it knows which PHP session to use (hint: the user can change the cookie and switch PHP session, extra checking is needed)
    – Tom J Nowell
    Dec 14, 2023 at 16:29
  • also take a look at the REST API, REST endpoints allow you to use AJAX on a pretty URL that responds in JSON natively with actual error handling, schemas, etc
    – Tom J Nowell
    Dec 14, 2023 at 16:30
  • @TomJNowell so using webhooks to maintain the cart with ajax calls is a better idea? than using a custom ajax class
    – Jan
    Dec 18, 2023 at 7:57

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.