[JamesAB]

I'm far from a javascript expert (I'm a PHP guy) and I've been trying to give myself a crash couse in Yahoo/YUI this week. That's why I've been asking for help and assuming it was my mistake, but I'm finally coming to the conclusion that this is probably a YUI quirk.

I haven't found any documentaion on this yet, but it appears that the first half of the POST vars on this uploader have to be string literals. You CANNOT use any varibles here...or at least I can't get the simpliest example to work.

If it's true, this would explain why I can't get any version to work with the SESSIONURL variable added either.

// THIS WORKS
uploader.upload(fileID, "http://tforum.mydomain.com/uploadzip.php", 
                "POST", 
                {"do":"doupload", 
		"albumid":jababumid, 
		"jabuniquezip":jabuniquezip,
		"securitytoken":SECURITYTOKEN}, 
		"upload");

as opposed to

// THIS DOES NOT WORK
var vbsessionurlsecuritytoken = "securitytoken";
uploader.upload(fileID, "http://tforum.mydomain.com/uploadzip.php", 
                "POST", 
                {"do":"doupload", 
		"albumid":jababumid, 
		"jabuniquezip":jabuniquezip,
		vbsessionurlsecuritytoken:SECURITYTOKEN}, 
		"upload");

With the second version, when a variable is used instead of the actual string, I get a CSRF error.

Am I missing something?
Or should I give up on this?

Thanks,
James