Keeping track of sessions

[kasuals]

Well, since my entire project is basically PHP I'd like to handle sessions in PHP as well.

What would be the best way to handle a login session in PHP? I want to keep track of users, and make sure that after a timeout of (x) they are logged out, and kill the session if they are logged out.

I haven't done much research yet, I figured I would pose the question to my peers to get a few suggestions of the best method before researching.

Thanks in advance.

http://www.angsttechnology.com

- "Delightfully confusing..." raves The New York Times

-kas

 

[sleipnir214]

PHP has its own session-handling mechanism.

Session handling is documented in the online manual at

http://www.php.net/manual/en/ref.session.php

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[kasuals]

Sleip:

I read a few posts back about session security. Should I just stick to using cookies in your opinion?

http://www.angsttechnology.com

- "Delightfully confusing..." raves The New York Times

-kas

 

[sleipnir214]

Yeah, PHP will do cookie-based or URL-based sessions.

According to the online manual page I posted earlier, URL based session management has additional security risks compared to cookie based session management. Users may send an URL that contains an active session ID to their friends by email or users may save an URL that contains a session ID to their bookmarks and access your site with the same session ID always, for example.[/u]

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[kasuals]

Thats kind of what I figured. Awesome, thanks for the link, I'll read up on it.

Appreciate your thoughts.

http://www.angsttechnology.com

- "Delightfully confusing..." raves The New York Times

-kas

 

[neilyalowitz]

Silly question here:
What if a user has their cookies turned off?
Are there any methods of passing variables between PHP scripts without using a cookie?

Thanx in advance,

Neil

 

[DRJ478]

neilyalowitz:

The answer is: YES.
It's really not PHP, but you would pass hidden fields that are written on every sucessive page. That way you could pass the values on to a script that is accessed via POST or GET.
If it's accessed via a link, the values are gone (unless the link has GET parameters).

If a user has cookies turned off, I'd tell him/her to turn cookies on, or not use the service.