|
|
 |
XCIII. Session handling functions
Session support in PHP consists of a way to preserve certain data
across subsequent accesses. This enables you to build more
customized applications and increase the appeal of your web site.
If you are familiar with the session management of PHPLIB, you
will notice that some concepts are similar to PHP's session
support.
A visitor accessing your web site is assigned an unique id, the
so-called session id. This is either stored in a cookie on the
user side or is propagated in the URL.
The session support allows you to register arbitrary numbers of
variables to be preserved across requests. When a visitor accesses
your site, PHP will check automatically (if session.auto_start is
set to 1) or on your request (explicitly through
session_start() or implicitly through
session_register()) whether a specific session
id has been sent with the request. If this is the case, the prior
saved environment is recreated.
All registered variables are serialized after the request
finishes. Registered variables which are undefined are marked as
being not defined. On subsequent accesses, these are not defined
by the session module unless the user defines them later.
The track_vars and
register_globals
configuration settings influence how the session variables get
stored and restored.
참고:
As of PHP 4.0.3, track_vars is
always turned on.
If track_vars is
enabled and register_globals
is disabled, only members of the global associative array
$HTTP_SESSION_VARS can be registered as session variables. The
restored session variables will only be available in the array
$HTTP_SESSION_VARS.
예 1.
Registering a variable with track_vars
enabled
<?php
session_register("count");
$HTTP_SESSION_VARS["count"]++;
?> |
|
If register_globals
is enabled, then all global variables can be registered as session
variables and the session variables will be restored to
corresponding global variables.
예 2.
Registering a variable with register_globals
enabled
<?php
session_register("count");
$count++;
?> |
|
If both track_vars and
register_globals
are enabled, then the globals variables and the $HTTP_SESSION_VARS
entries will reference the same value.
There are two methods to propagate a session id:
The session module supports both methods. Cookies are optimal, but
since they are not reliable (clients are not bound to accept
them), we cannot rely on them. The second method embeds the
session id directly into URLs.
PHP is capable of doing this transparently when compiled with
--enable-trans-sid. If you enable this option,
relative URIs will be changed to contain the session id
automatically. Alternatively, you can use the constant
SID which is defined, if the client did not
send the appropriate cookie. SID is either of
the form session_name=session_id or is an empty
string.
The following example demonstrates how to register a variable, and
how to link correctly to another page using SID.
예 3. Counting the number of hits of a single user <?php
session_register ("count");
$count++;
?>
Hello visitor, you have seen this page <?php echo $count; ?> times.<p>
<php?
# the <?=SID?> is necessary to preserve the session id
# in the case that the user has disabled cookies
?>
To continue, <A HREF="nextpage.php?<?=SID?>">click here</A> |
|
The <?=SID?> is not necessary, if
--enable-trans-sid was used to compile PHP.
To implement database storage, or any other storage method, you
will need to use session_set_save_handler() to
create a set of user-level storage functions.
The session management system supports a number of configuration
options which you can place in your php.ini file. We will give a
short overview.
session.save_handler defines the name of the
handler which is used for storing and retrieving data
associated with a session. Defaults to
files.
session.save_path defines the argument which
is passed to the save handler. If you choose the default files
handler, this is the path where the files are created.
Defaults to /tmp.
session.name specifies the name of the
session which is used as cookie name. It should only contain
alphanumeric characters. Defaults to
PHPSESSID.
session.auto_start specifies whether the
session module starts a session automatically on request
startup. Defaults to 0 (disabled).
session.cookie_lifetime specifies the lifetime of
the cookie in seconds which is sent to the browser. The value 0
means "until the browser is closed." Defaults to
0.
session.serialize_handler defines the name
of the handler which is used to serialize/deserialize
data. Currently, a PHP internal format (name
php) and WDDX is supported (name
wddx). WDDX is only available, if PHP is
compiled with WDDX
support. Defaults to php.
session.gc_probability specifies the
probability that the gc (garbage collection) routine is started
on each request in percent. Defaults to 1.
session.gc_maxlifetime specifies the number
of seconds after which data will be seen as 'garbage' and
cleaned up.
session.referer_check contains the substring you
want to check each HTTP Referer for. If the Referer was sent by the
client and the substring was not found, the embedded session id will
be marked as invalid. Defaults to the empty string.
session.entropy_file gives a path to an
external resource (file) which will be used as an additional
entropy source in the session id creation process. Examples are
/dev/random or
/dev/urandom which are available on many
Unix systems.
session.entropy_length specifies the number
of bytes which will be read from the file specified
above. Defaults to 0 (disabled).
session.use_cookies specifies whether the
module will use cookies to store the session id on the client
side. Defaults to 1 (enabled).
session.cookie_path specifies path to set
in session_cookie. Defaults to /.
session.cookie_domain specifies domain to
set in session_cookie. Default is none at all.
session.cache_limiter specifies cache control
method to use for session pages (nocache/private/public).
Defaults to nocache.
session.cache_expire specifies time-to-live
for cached session pages in minutes, this has no effect for
nocache limiter. Defaults to 180.
참고:
Session handling was added in PHP 4.0.
User Contributed Notes
Session handling functions |
 add a note |
aviad at bettagroup dot com
13-Aug-2000 02:27 |
|
When putting objects in a session, you need to have declared the class of
your session managed objects BEFORE they are restored with a
session_register or equivalent call.
That means before the
session_start()!
|
|
shanemayer42 at yahoo dot com
20-Aug-2000 02:11 |
|
Session Garbage Collection Observation:
It appears that session
file garbage collection occurs AFTER the current session is loaded.
This means that:
even if session.gc_maxlifetime = 1 second,
if someone starts a session A and no one starts a session for an
hour, that person can reconnect to session A and all of their previous
session values will be available (That is, session A will not be cleaned
up even though it is older than gc_maxlifetime).
|
|
ricmarques at spamcop dot net
16-Oct-2000 12:16 |
|
Regarding session.cache_limiter :
For those of you who - like me -
had trouble finding the meaning of the possible values (nocache, public
and private), here's the explaination taken from the HTTP 1.1
Specification at
"14.9.1
What is Cachable
[snip]
public
Indicates that the
response is cachable by any cache, even if it would normally be
non-cachable or cachable only within a non-shared cache. (See also
Authorization, section 14.8, for additional
details.)
private
Indicates that all or part of the
response message is intended for a single user and MUST NOT be cached by
a shared cache. This allows an origin server to state that the specified
parts of the response are intended for only one user and are not a valid
response for requests by other users. A private (non-shared) cache may
cache the response.
Note: This usage of the word private only
controls where the response may be cached, and cannot ensure the privacy
of the message content.
no-cache
Indicates that all or part
of the response message MUST NOT be cached anywhere. This allows an origin
server to prevent caching even by caches that have been configured to
return stale responses to client requests.
Note: Most HTTP/1.0
caches will not recognize or obey this directive."
|
|
j at rtchat dot com
28-Dec-2000 03:49 |
|
To get more secure session IDs, here is what I use on GNU/linux
:
ini_alter("session.cookie_lifetime",
"86400");
ini_alter("session.entropy_file","/dev/urandom");
ini_alter("session.entropy_length",
"512");
You can also use /dev/random instead of
/dev/urandom but it's a slower.
|
|
j dot mccoy at cc dot utexas dot edu
03-Jun-2001 07:53 |
|
If your using PHP session handling with PostgreSQL as session storage, a
efficient method of handling garbage collection would be a
rule:
create rule rle_sessions_gc as on insert into sessions
where (random() >= 0.7) do delete from sessions where expiry <=
current_timestamp;
this rule assumes that the sessions table has
an expiry field into which is placed the timestamp at which the session
should expire; change the value random is checked against to change the
probability of garbage collection.
|
|
xpo at allrecords dot de
01-Aug-2001 12:12 |
|
Small but i think helpfull comment:
Using
session_name("xyz"); requires a session_name("xyz");
before EACH session_start();. Otherwise everytime you call the needed
session_start(); in your script, a new session is defined and your
registered vars are lost.
--xpo
|
|
j dot marloweNOSPAM at gmx dot NO_SPAM dot net
11-Feb-2002 09:47 |
|
for anyone in the need of a simple login script tutorial featuring
sessions, try here:
|
|
stoiev at ig dot com
20-Mar-2002 04:10 |
|
Carefull when you are working in PHP with WML. The arg separator used to
put de PHPSESSID variable in URL is '&' by default, and this cause a
Compile Error in browsers:
<anchor><go
href="index.php?estate=1&PHPSESSID=12345678abcde"></go>
instead
of this:
<anchor><go
href="index.php?estate=1&PHPSESSID=12345678abcde"></go>
It�s
safety include the line:
ini_set ( "arg_separator",
"&");
to change the arg separator, it worked in
PHP 4.1.2
Another thing that the onpick tag is not defined in the
url_rewriter.tags list by default(if there are others, i don�t now). This
is must be added in php.ini file.
* In most case the WAP GateWay
accepts cookies an the auto-transpass-SID is not necessary, it�s hard to
find problems with this.
|
|
Joerg Aldinger
10-May-2002 11:26 |
|
After having had a hard time with a provider who has --enable-trans-sid
disabled, i've created this little piece of code to automatically add the
session id to internal links and forms. It assumes you have the whole page
loaded into $page. (Remove whitespaces from $search when
copying!)
$mySID = session_name().'='.session_id();
$search =
array(
"'(<a[^>]*href=\"
(?!)
[^?\">]*\\?[^\">]*)\"'iU",
"'(<a[^>]*href=\"
(?!)
[^?\">]*)\"'iU",
"'(<form[^>]*action=\"
(?!)
[^?\">]*\\?[^\">]*)\"'iU",
"'(<form[^>]*action=\"
(?!)
[^?\">]*)\"'iU");
$replace = array(
'\\1&'.$mySID.'"',
'\\1?'.$mySID.'"',
'\\1&'.$mySID.'"',
'\\1?'.$mySID.'"');
$page =
preg_replace($search, $replace, $page);
|
|
twocandles3000@hotmail
14-May-2002 06:34 |
|
Storing class instances in session.
As long as a class MUST be
declared BEFORE the session starts and unserializes the session info, i'm
using this approach.
0: Set in php.ini session.auto_start = 0
1:
create myclass.inc where the class is declared.
2: put in another file,
say header.inc, this lines of code:
include_once(
"myclass.inc" );
session_start();
3: set in php.ini the
auto_prepend_file= "path_to_my_file/header.inc"
Following
this steps, the session is started at every page and myclass is always
available, avoiding to write the session_start() function at every
page.
php 4.2.0 and 4.2.1, Apache 1.3 and W2K Pro.
|
|
php at tiv dot net
25-May-2002 09:01 |
|
I wrote a tiny "shopping-cart" code when I was learning PHP
sessions. (Use ++ instead of =1 to allow more than one product of a kind
in the cart).
<?php
session_start();
// - Add
if(
isset( $_GET['ADD'] ) ) {
$_SESSION['aBasket'][$_GET['ID']] =
1;
}
// - Remove
if( isset( $_GET['DEL'] ) )
{
unset($_SESSION['aBasket'][$_GET['ID']]);
}
// - Remove
All
if( isset( $_GET['EMP'] ) )
{
unset($_SESSION['aBasket']);
}
// - Show
if( isset(
$_SESSION['aBasket'] ) ) {
foreach ( $_SESSION['aBasket'] as
$key=>$val ) {
echo "$key
";
}
}
?>
<form>
Product:
<input
type="text" name="ID">
<input
type="submit" name="ADD"
value="Add">
<input type="submit"
name="DEL" value="Del">
<input
type="submit" name="EMP"
value="Empty">
</form>
Gregory
|
|
jmgonzal_NOSPAM_at_NOESPAM_netred_DOT_cl
12-Oct-2002 10:43 |
|
If you have problem to download a file from your PHP , and you have IE (any
version) and apache for server with SSL, check the reference of:
session-cache-limiter
My best solution is change the php.ini
from
session.cache_limiter =
nocache
to:
session.cache_limiter = private, must-revalidate
|
|
wloskeANTISPAM at yahoo dot de
30-Oct-2002 03:00 |
|
Just to prevent you from falling into a pit when working with
sessions
and cookies.
In contrast to setcookie() the session.cookie_lifetime
expects an integer which is added automaticaly to the current
time().
So don't set session.cookie_lifetime to something
like
time()+int or your session cookie will life a very long
time
;-))).
If you want to expire your session at the same date
when
your cookies expire try something
like:
----------------------------------------------------------
$session_expire
= 86400;
$cookie_expire =
time()+$session_expire;
ini_set("session.cookie_lifetime",$session_expire);
session_start();
setcookie("cookie",
"content", $cookie_expire,
"/");
----------------------------------------------------------
Have
a nice day ...
|
|
Jester at free2code dot net
17-Nov-2002 09:50 |
|
It seems quite a lot of people have trouble understanding what sessions do
and what they're good for.
For a more newbie explanation our
tutorial might help you:
I
tried to expplain how to use sessions in as simple terms as possible, for
anyone having trouble understanding this page, give it a go.
|
|
phred at priest dot com
21-Nov-2002 12:15 |
|
I messed around with that a whole afternoon:
$_SESSION is already a
global variable. However, if you add global $_SESSION in you function, it
could be that on the rest of the page, all things entered into the
sessions are lost at the next call of the site...
|
|
thebitman at attbi dot com
16-Dec-2002 07:01 |
|
[Editor's Note] Locking a session to an IP address will sometimes result in
valid user's sessions not being restored. ISPS sometimes use more than
one proxy server, the ISP may direct the traffic through a different proxy
on each request[/Note]
The easiest (and therefor, most
vulnerable) method of validating a session is to just keep a copy of the
REMOTE_IP in $_SESSION, and compare it at the beginning of your script. Of
course this doesnt prevent someone from blindly sending things to your
server and getting no reply, but I think it will do a pretty good job of
preventing someone from hijacking your session in order to get ahold of an
order confirmation page that has your address and CC# on it.
As a
general rule: Keep track of your users. NEVER allow POST data for things
like online purchases without making sure that the last page they were on
is the page that should be making that POST (and I dont mean checking the
referer: header. This kind of thing is what the _SESSION variable can be
good for storing)
|
|
mark6139 at yahoo dot com
26-Dec-2002 06:54 |
|
As a more general follow-up to Ryan's note from 11/23, just don't use any
local variables with the same name as a member of the $_SESSION array.
Doing so for me messed things up even in the simplest case (where I did
not unset the session array member).
|
|
jules at dsf dot org dot uk
16-Jan-2003 08:13 |
|
There are a few comments above about how using sessions might not be
secure, but quite apart from session hijacking, there is a mistake that I
think a lot of people are making at the moment that everyone needs to stop
and make sure they aren't one.
This mistake arises from having the
'register_globals' setting on.
Take the following example code
which is meant to maintain a session variable for whether a user is logged
in and allow them to log in using a username and password if they aren't
logged in, or give an option for logging out if they
are:
<?php
session_register ("logged_in");
if (!strcmp($user, "user") && !strcmp($pass,
"password"))
$logged_in = 1;
if ($logout)
$logged_in = 0;
if ($logged_in)
echo "logged in.
<A href=\"sestest.php?logout=1\">log
out</A>";
else
echo "<FORM
action=sestest.php method=get>User: <INPUT type=text
name=user>
Password: <INPUT type=text name=pass>
<INPUT
type=submit></FORM>";
?>
This works fine under
normal use, but an attacker can log in without knowing the username or
password by accessing '.../sestest.php?logged_in=1', which will set the
session variable 'logged_in' to the value 1.
However, once a
session variable has been set, it cannot be overridden in this fashion, so
one solution is to use code like the code shown above (which has no
explanation attached as to why you should do it that way) that uses
session_is_registered:
<?php
session_start ();
if
(!session_is_registered ("logged_in"))
{
$logged_in
= 0;
session_register ("logged_in");
}
...
?>
|
|
nutbar at innocent dot com
17-Jan-2003 09:44 |
|
Someone posted a message here saying you should just all use the MM shared
memory management for sessions. I'd like to CAUTION EVERYONE against
using it!
I run a few webservers for a webhosting company, and we
quickly ran in to PHP pages segfaulting Apache for unknown reasons, until
we did a test with sessions. It turns out that the sessions, while using
the mm stuff, couldn't keep the data right. I guess it was to do with the
file locking issue mentioned in the documentation here (I didn't notice
this until now!).
Anyways, if you run a Unix machine that can map
virtual memory to a mount point (like tmpfs or shm or whatever it may be
called), use this instead. It's volatile like mm, but works. Only thing
you don't get is hidden session info so that other people don't know how
to open it easily - but it's better than trying to use mm and having the
webserver crash all the time!
|
|
duke at mastre dot com
22-Jan-2003 06:39 |
|
Since session.gc_maxlifetime and the general gc are somewhat broken on
different platforms (including Linux), it's simpler/better/faster to write
your own expiration code.
define(EXPIREINSECONDS, 15 * 60); // 15
minutes
if (isset($_SESSION['timestamp']) && (date('U') -
$_SESSION['timestamp']) > EXPIREINSECONDS)
session_destroy();
else
$_SESSION['timestamp'] =
date('U');
Simple enough? ;) Note that it's better to write a
logout() function and destroy all session data manually before calling
session_destroy() - for example, if running in non-cookied mode session
data is not destroyed for the lifetime of the script instance calling
session_destroy(), only for subsequent calls.
|
|
ek at aperion dot net
24-Jan-2003 06:24 |
|
session.gc_maxlifetime is the number of seconds to wait since the last
access time of a given session before marking it as garbage on the server.
|
|
sbeam at rtint dot net
24-Jan-2003 08:54 |
|
$_SESSION support in PHP 4.1.2 is BROKEN! dont go crazy like I did trying
to figure it out. You will have to upgrade if you want to use
sessions.
note
this buggy version is in the current ftp updates for Redhat 7.2 and 7.3 -
it also has a major security flaw.
|
|
tim at digicol dot de
04-Feb-2003 05:14 |
|
Be careful when using ini_set to change the session.gc_maxlifetime value
locally for your script:
You will trash other people's sessions
when garbage collection takes place (and they will trash yours) regardless
of their (your) intended session.gc_maxlifetime, because the session_name
is not taken into account during garbage collection.
Create an own
directory and set session.save_path to it, so that your session files
don't get mixed.
|
|
christian at uslfinancials dot com
10-Feb-2003 03:12 |
|
We were running PHP 4.1.2 to make a web app that heavy use of session vars.
We made of couple of functions that would go thru and delete session
variables in masse: such as
//Function for clearing all $_SESSION
variables but the
// Authentication ones
function clear_session
() {
GLOBAL $_SESSION
foreach ($_SESSION as $key => $value)
{
//Don't Destroy the Authenication Vars
if (!strstr($key,
"AUTH")) {
$_SESSION[$key] =
"";
unset($_SESSION[$key]);
}
}
}
Notice the 'GLOBAL $_SESSION' --- not needed
right? Well without it the Windows PHP/Apache Environment crashes.
If you move up to > PHP4.2.0 this kind of code will mess with
your app. --- get rid of them all! No longer needed - WAMP will no longer
crash.
|
|
Dan
05-Mar-2003 10:47 |
|
Sessions expire randomly? Running many related sites, which people may view
at the same time? Make sure you use a different directory for the session
save path of each virtual host (by default, the session files will go into
/tmp, so create sub directories there, such as sess_dir1 and set
permissions correctly)! Put a .htaccess file in the root of each site, and
include 'php_value session.save_path /tmp/sess_dir1' in that
file.
I had two sites (company.com and x.company.com) which shared
the /tmp folder for sessions, and typically both sites would be open at
the same time. Somehow the sessions were shared - not sure why but using
different folders for the save_path solved the problem. This is a good
idea anyway if you host many sites, but these were both company sites on a
single server.
|
|
Devin Emke
12-Mar-2003 06:08 |
|
It appears that you cannot really mix and match the old and new ways of
registering session variables.
old:
register_globals = ON
$name = 'John Smith';
session_register ('name');
new:
register_globals = OFF
$_SESSION['name'] = 'John Smith';
with register_globals = ON any changes to a global variable will
effect the $_SESSION array when the session is reloaded:
<?
// register_globals = ON
session_start
();
$_SESSION['test'] = 'this is a test';
$test = strtoupper
($test);
print_r ($_SESSION);
?>
When this script is run
and then refreshed (reload the session) $_SESSION['test'] will equal 'THIS
IS A TEST'
|
|
aktor789 at hotmail dot com
18-Mar-2003 11:36 |
|
Note that session_register() is a function, whereas $_SESSION is an array.
For instance if you send a variable, "v", with a querystring as
e.g. mypage.php?v=1 you can register this variable AND its value simply
by: session_register("v");
But thinking that this is
euqal to $_SESSION['v'] is wrong, because the FUNCTION session_register()
also registers the value of "v" (already sent with the
querystring), whereas $_SESSION['v'] will only register the variable, but
not its value. If the value is sent by a querystring, it can be registered
by: $_SESSION['v']=$v;
|
|
quinn at strangecode dot com
19-Mar-2003 09:10 |
|
Do not 'global' a superglobal! If you register a $_SUPERGLOBAL as a global
variable (as in... global $_SESSION; within a function definition)
strange things happen with some versions of PHP (PHP 4.2.3 on my MacOS X
powerbook, but not my PHP 4.2.3 RH 7.3 linux machine). In the case I
found, $_SESSION and $HTTP_SESSION_VARS would not reference the same data,
and unsetting or accessing the data was inconsistant. Didn't test very
far, but obviously this should not be done, and it did wreck havoc for me.
|
|
onp at home dot se
14-Apr-2003 12:32 |
|
In response to "[email protected]" on the garbage
collector.
You can make it work... like
this:
session_start();
$session_timeout = 10; // number of
seconds till timeout
if (isset($_SESSION['last_access']) &&
$_SESSION['last_access'] < (time() - $session_timeout)) {
session_destroy();
} else {
$_SESSION['last_access'] =
fileatime('/path/to/sessions/sess_' . session_id());
}
|
|
jvilla at isdesigndev dot com
26-Apr-2003 09:10 |
|
=======================================
Here is script I have been using
to authenticate the session and the user
//after successful
database authentication with username AND password match
//get the
unique time that this user has logged in at
$time_started =
md5(mktime());
//encrypt the username and
password
$secure_session_user =
md5($_POST['username'].$_POST['password']);
//get the current users
username
$_SESSION['session_user'] = $_POST['username'];
//this
session_key will be used to authenticate on every page / getIPADDR() is a
function which just return the ip address (I found here on
php.net)
$_SESSION['session_key'] =
$time_started.$secure_session_user.getIPADDR().session_id();
$_SESSION['current_session']
= $_POST['username']."=".$_SESSION['session_key'];
//my
own function which redirects the
user
p_redirect("../account/profile_home.php");
//So
now we have 3 SESSION vars which we will use for authentication
1.
$_SESSION['current_session']
2. $_SESSION['session_key']
3.
$_SESSION['session_user']
//On every page, we include a file called
verify_session.php which has the following code
if
($_SESSION['current_session'] !=
$_SESSION['session_user']."=".$_SESSION['session_key'])
header("location:../login/index.php?auth_msg=".urlencode("Your
session has expired, please login again"));
if ($logout ==
"logout")
{
$_SESSION['current_session'] =
rand(100,9000000);
$_SESSION['curr_sess_iden'] =
rand(100,9000000);
$_SESSION['session_user'] = "Oscar the
Grouch";
$_SESSION['session_key'] =
rand(100,9000000);
header("location:../login/index.php?auth_msg=".urlencode("You
have been logged out"));
}
//and in our navigation, we have
a logout link as simple as
<a href="<? $_SERVER['PHP_SELF']
?>?logout=logout">Logout</a>
Hope it helps
someone....
|
|
spooooom at hotmail dot com
03-May-2003 04:54 |
|
I was recently working on a project using sessions and I wanted to make it
XHTML 1.1 compliant. However, PHP had its own ideas. ;)
When using
sessions, and especially when used via the W3C validator script (which
doesn't allow cookies to be set), PHP inserts the session ID in a few
different ways.
In links:
<a
href="forum.php?fid=1&PHPSESSID=df88be559beb18f9e5ccb2adb6d80922">
This
is invalid in XHTML 1.0 Strict or 1.1 because it tries to use PHPSESSID as
an HTML entity, such as (and of course fails and generates a
few errors). To fix, set
arg_seperator.output =
"&"
in php.ini, put
php_flag arg_seperator.output
"&"
in your .htaccess, or
use
ini_set("arg_seperator.output",
"&");
somewhere in your code (before
session_start();).
In forms:
<form id="clockform"
action="nonenaddazipzeroblah.php"><input
type="hidden" name="PHPSESSID"
value="df88be559beb18f9e5ccb2adb6d80922" />
This is
invalid in 1.0 Strict or 1.1 because elements in the form need to be
inside a block level element, such as <div> (which, from my testing,
needs to be inside the form). To fix, set
session.use_trans_sid =
0
in php.ini, put
php_flag session.use_trans_sid off
in your
.htaccess, or use
ini_set("session.use_trans_sid",
"0");
somewhere in your code (before session_start();).
|
|
etonphp at igels dot net
14-May-2003 11:37 |
|
Hi,
this is a comment to the note from jvilla at isdesigndev dot com
posted on 26-Apr-2003 03:10.
Everything you save in $_SESSION will
be saved on the server, so if I'm not totally wrong all you do helps
nothing. You can check the IP address or the browser
($_SERVER['HTTP_USER_AGENT'] != $_SESSION['browser'] ...), and you should
check if this is an old session (timeout), but if somebody take over a
session, $_SESSION['current_session'] != $_SESSION['session_user']
."=". $_SESSION['session_key']) wouldn't notice.
Sorry
for my buggy english,
iGEL
|
|
|
add a note |
| |
PHP Manual
Function Reference
아파치
sesam_settransaction