PHP Sessions

So a little about PHP Sessions. I’ll talk briefly about how they persist, how long they persist, how to add variables and how to destroy/unset variables. As stated on the php.net website

Session support in PHP consists of a way to preserve certain data across subsequent accesses. This enables you to build more customized applications and increase the appeal of your web site.

Well, as helpful as that definition is, the whole idea behind sessions is that they can persist beyond a single page request.This allows us to maintain data longer than a single request. This is beneficial to maintain login information/credentials, preserving error messages during redirects, etc. Sessions, by default persist for 24 minutes (1440 seconds).This timeout can be overridden by setting the gc_maxlifetime ini variable as follows:

ini_set(‘session.gc_maxlifetime’,n); // n in this example is the number of seconds before timeout.

For the purposes of this tutorial/example, I’ll primarily explain using login/user management as the example. When a site visitor logs into a website, it’s important that we recall who they are as well as what they should have access to. To persist a session variable, the following line of code must appear before any output on the page. If you have a space or any other output on the page prior to the session variable being set, you will see the following error:

Cannot send session cookie. Headers already sent.

This error indicates that the browser has already been provided content. This could be white-space or the output of some content. In order for content to be sent, the headers have to be closed. If the headers are closed, nothing more can be added to them. Including session data. OK, enough of the warning/lecture. Here’s the nitty gritty.

<?php

session_start();

?>

The session start() function must be located on every page to carry the session variables. The easiest way I’ve found to do this is by adding an include to every page. This include should have only php code and all of your variables that are needed globally can be added to this file. This prevents you from having to type the same code on multiple pages.

Now that the session exists, you can add data to the $_SESSION variable to persist until the session dies. Setting session variables is actually quite simple:

$_SESSION['username'] = ‘shaun’;

While this example works in the context I have used it, it’s not necessarily the most secure or efficient way to do store variables. I typically suggest streamlining it a bit more. By this I mean organizing the session better. Take a look at this example:

$_SESSION['user']['username'] = ‘shaun’;
$_SESSION['user']['user_level'] = ‘administrator’;

That is a more efficient way of organizing your data, feel free to branch it out as far as you need to. This allows you more flexibility and makes the code easier to read. You can keep adding variables to the session while keeping all of the user data in a clean organized variable.

I always suggest against storing user data in sessions. Rather, I would encourage the use of storing a record ID and validating the data against your database server to keep your data and website secure. This prevents users from manipulating your code to update the variables and gaining access to your database records.

I hope this proves to be helpful and if you have any questions, feel free to leave a comment.

Tags: cookie, gc_max_lifetime, headers already sent, login, php, protection, sessions, session_start, username

This entry was posted on November 11, 2008 at November 11, 2008 and is filed under Code Help, php. You can follow any responses to this entry through the RSS 2.0 feed.