Session Question

[Anon]

I'm currently creating a site that requires users to log in and then keep track of whether or not they are logged in until they leave. I'm thinking sessions are the best way to do this, but i'm wondering if I get over 100 people on at a time if this will significantly slow my crappy server down. I thought about cookies, but that'd be too easy to manipulate. Any ideas?

~john

[Anon]

I always think the best policy is to try something out, and find out whether your server buckles. I would be inclined to think that you will be O.K. One thing to remember, is that apache doesn't understand 100 people being logged into your site. HTTP is stateless. Apache waits for a request, responds and then waits. So If you have 100 people logged into your site, but they are all idle (not making any requests) then it is equivalent to having no-one logged into your site. The place that HTTP servers get into trouble is when they have a large number of concurrent requests. In other words, Apache received 100 requests for data at the same time. Also remember, that using php sessions, cookies are passed.

[rontgoff]

Use session id which refers back to your db to see it is good or not. generate a random number for you sess id I use a random 128 char id very hard to duplicate or guess a correct combo. cookies are fine use the one sess id variable and let php mysql handle the rest