How To Use PHP Sessions

Estimated reading: 5 minutes 34 views

About PHP sessions

The HTTP protocol is stateless. Stated differently, a website does not retain any visitor data as they navigate from one page to the next. If you wish to monitor specific users while they browse a website, this is an issue. An online banking application or shopping cart are two typical examples of applications that require this feature.

PHP sessions allow you to save information related to each visitor to your website and get beyond the stateless constraints of HTTP. Your website may retain information about users as they explore it with just a few lines of code.

PHP Session Start

When you start a session, the web server generates a session identifier that uniquely identifies the visitor. By default, session data is stored in the server’s /tmp directory in files that are named sess_ followed by a unique alphanumeric string (the session identifier).

To start a session, use the PHP session_start() function. Because the PHP session_start() function sends information in the HTTP headers, though, you must call this function before the page generates any content. The following sample code demonstrates how to do this:

<?php
    session_start();
?>

<html>
    <head>
        <title>Test page</title>
    </head>
    <body>
        <p>Hello</p>
    </body>
</html>

By itself, the session_start() function doesn’t add much functionality to a web page. You need to use PHP session variables to really tap into the potential of PHP sessions.

For more information about the session_start() function, please visit http://www.php.net/manual/en/function.session-start.php.

Working with PHP session variables

The $_SESSION associative array allows you to store session data in variables. For example, suppose you want to implement a very simple hit counter for a page. You can’t do this with a generic HTML page. With PHP sessions, though, it’s easy. The following code sample demonstrates one way to do this:

<?php
    session_start();
    $_SESSION['hits']++;
?>

<html>
    <head>
        <title>Simple page hit counter</title>
    </head>
    <body>
        <p>You have visited this page <?php print $_SESSION['hits'] ?> times.</p>
    </body>
</html>

In this example, we define a variable named hits that is stored in the $_SESSION array. Each time the page is loaded, the hits value increases by one.

It is easy to add additional PHP session variables to the $_SESSION array. All you have to do is reference the variable name you want to use, and PHP takes care of the rest, tracking its value across multiple HTTP connections.

For more information about the $_SESSION array, please visit http://www.php.net/manual/en/reserved.variables.session.php.

Ending a session

To end a session, use the session_destroy() function. This function deletes all server-side data for the current session.

For example, adding the session_destroy() function to our page counter sample code above wouldn’t make much sense, because the value of the hits variable would be destroyed every time the page is loaded. (The page would always display “You have visited this page 1 times” no matter how many times you load it.)

On the other hand, suppose your site has a shopping cart application. A user adds products to the cart on one page, fills out the order information on another page, and finally checks out. After the user checks out and completes the purchase, you probably want to empty the cart and reset the PHP session variables. The session_destroy() function enables you to do this.

For more information about the session_destroy() function, please visit http://www.php.net/manual/en/function.session-destroy.php.

Session settings in php.ini

There are numerous settings available in the php.ini file that enable you to configure how sessions function on your web site. For example, the session.cookie_lifetime setting enables you to control how long a session cookie remains valid, and the session.auto_start setting enables you to start sessions automatically instead of calling the session_start() function explicitly. Another important option is the session.save_path setting, which enables you to specify where PHP stores session files (by default, they are stored in the server’s /tmp directory, but you may prefer to store them somewhere in your own directory instead).

For detailed information about all of the session settings available in the php.ini file, please visit http://www.php.net/manual/en/session.configuration.php.

Session security

Working with PHP sessions requires you to be aware of a number of security issues. For instance, you need to defend against potential fixation and session hijacking threats.

For more information about PHP session security, please visit http://www.php.net/manual/en/session.security.php.

How to order an unmanaged VPS

How To Use PHP Sessions

About PHP sessions

PHP Session Start

Working with PHP session variables

Ending a session

Session settings in php.ini

Session security

How To Use PHP Sessions

CONTENTS