How to set a PHP object in session upon a hyperlink click

Adding an object to the session:

$_SESSION['the_object'] = $object;

(Disclaimer: Will not work if the object contains any non-serializable components like closures)

Now when to do it? Actually, you have to do it on the page that shows the data, because if you do it later when the user clicks the edit link, this already triggers a new request which then would again go to the database - you'd have two requests (one for the list, one for the edit).

Generally, the edit link has the ID of the database entry to be edited. But pay attention to carefully check whether the user is allowed to have access or not, because MySQL will simply increment the ID, so it's easy to guess which IDs are valid. Anyone with a tiny bit of clue can modify a HTML form to tamper with IDs.

The approach with the session is somewhat easier: You only allow to edit what has been stored in the session, so the access control has to be done on the list page only.

For those who may be looking for a code snippet to help do this - here it is

Page 1 - this page just loads data from a DB and displays it in a non-editable mode on the screen. On this page we need an Javascript function that can be activated when the hyperlink is clicked

<script language="JavaScript" type="text/javascript">
    function processEditLink(){
        $.post('process_session_put.php', <?php echo "{S-Object:'".json_encode($obj_)."'});"; ?>
        window.location.href = 'edit_object.php';
    }
</script>   

To explain the above code - we are taking an object (referred to as obj_) and encoding it into the JSON version by using the inbuilt function json_encode. Remember to ensure your object implements JsonSerializable in order to accomplish this. After that we are passing that JSON string as a POST URI parameter via AJAX to a secret page called process_session_put.php. This call is never visible to the end user and happens secretly when the hyperlink is clicked. The secret PHP page will decode the JSON string back into the PHP object and put it in session for all to use. Finally, once that function is complete, the window redirects to the actual edit page that can access data from session and populate the screen.

Next we should modify the hyperlink to trigger this Javascript function when it is clicked as below

<a class="edit-link" href="javascript:processEditLink(this);return false;">[Edit]</a>

Finally - the PHP page called process_session_put.php - which actually does the background work of decoding the JSON string passed to it back into the object format and putting it in session

<?php

    if (!isset($_SESSION))
    {
        session_start();
    }

    // OBTAIN THE JSON STRING FROM POST URL, DECODE IT AND PUT IT BACK AS A OBJECT IN SESSION
    $_SESSION["E-Object"] = json_decode($_POST["S-Object"]);
?>