How to handle session in my website...

[misterimran]

Hello,

I have been searching a lot to find a solution how to handle session in my web site developed in PHP.

All i want to do is:

1) Expire a session if user user's session is idle for like 2 minutes.
2) To verify on each page is the user is logged on proerly through login page.

I have to use session variables to perform this.

Can anyone pliz help me through code how to do this. I will be really greatful to you. I dont want to do this by the help of cookies.

Regards,

Imran Baig

 

[sleipnir214]

I'm sorry, but I don't understand what you mean when you say, "I dont want to do this by the help of cookies."

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[misterimran]

Hi,

I mean i want to do this with the help of session variables.

Imran

 

[misterimran]

This is the code i have found on a website to handle sessions.

function doodle(){
//Verify
if($_SESSION['expire'] > mktime())
{
unset($_SESSION['s_user_id']);
session_destroy();
}// End if
}
session_start();
doodle();
if (isset($_SESSION['s_user_id'])) {
// Members area code
//Initialize expire variable
$_SESSION['expire'] = mktime() + 60;
// Current time + 120 seconds
}
// end If
else {
echo("Session expired!");
// Login code
}

BUT it is showing session_expired as soon as i refresh the page the page though runs for the first time.

please help me out!

Imran

 

[BabyJeffy]

I think you have a minor logic flaw. The following code tests to see if the contents of the "expire" session variable are in the future - if so then logout:

if($_SESSION['expire'] > mktime())

I think you should be checking to see if the contents are in the past (and therefore due for expiry). The following change should do the trick:

if($_SESSION['expire'] [b][COLOR=red]<[/color][/b] mktime())

I'm sure someone with more experience than I will correct me if I am wrong, but the following function is probably a more complete way to destroy your session:

/* function to completely destroy a session */
function logoutSession()
{
	/* clear the session array */
	$_SESSION = array();

	/* delete the session cookie (and not just the session data) */
	if (isset($_COOKIE[session_name()])) setcookie(session_name(), '', time()-42000, '/');

	/* Finally, destroy the session */
	session_destroy();
}

Cheers,
Jeff

[tt]Jeff's Page [/tt][tt]@[/tt][tt] Code Couch

http://www.codecouch.com/jeff/

[/tt]

 

[Vragabond]

Another not good thing is checking for session variables before the session was even initialized with session_start(). I guess it is possible you could be using session.auto_start but then I suppose you wouldn't be initializing the session a few lines lower.