Is my session ok??

jassh

hi there all...

Hope you guys are in best of health..

okay.. here's a question about session
that has been bugging me for the past few nights..
before that, just wanna tell that my GLOBAL are off by default
and i have change the /tmp in the session.save_path to "C:\Program Files\PHP\tmp"
i'm using Apache 1.3, PHP 4.3.0, on WIN2k SP3.

fisrt of all... i have a page 'begin_session.php'
which register a session
then i have the 'session.php',
which i check if the variables been carried foward or not...
then there is this 'end_session.php', destroying the session.

my question is..

Why is it that the file in my tmp file (set in php.ini)
for that session is not deleted when i uses the
unset($_SESSION['name']) command? is it supposed to be like that?
the file = sess_7e7566356f55bfeaa18bc536ce1bf375 [0kb]
I know there's this session_destroy(); thingy..
but it seems not to work, if swap it with session_start();
in my 'end_session.php'. have i dont wrong anywhere...??
what's the correct way to use session.. i studied some tutorial,
(especially the 'count' one), it doesnt really work that well...
the count doesnt increase when i refresh my page...
Do i have to use session_start(); on EVERY page??

so to make things a bit clearer.. here's my code...

Thanks in advanced....



<?php

//this is my begin_session.php

session_start();

$_SESSION['name'] = "jassh";

echo $_SESSION['name'];
echo "<BR>";

echo "<A HREF=session.php>SESSION2</A>";

?>





<?php


// this is my session.php
session_start();

$myname = $_SESSION['name'];


echo $myname;

echo "<BR>";

echo "<A HREF=end_session.php>DESTROY SESSION</A>";


?>




<?php

//my end_session.php

session_start(); //why is it when i change this to session_destroy(); it doesnt work.

//when should i uses the session_destroy() ??

unset($_SESSION['name']);

echo "Session Destroyed";
echo "<BR>";
echo "<A HREF=session.php>SESSION2</A>";


?>



//and lastly.. here's the tutorial that start the confusion..


<?

//this is my session_tutorial.php. the value does not increase when i refresh my page

session_start();
session_register('count');
$count++;
echo "<P>You've been here $count times.</p>";
?>

nnichols

When you use unset() like that it is only unsetting the variable, not destroying the session. So, yes that is correct.
session_destroy() should delete the session file in your tmp directory. You must call session_start() first for this function to work reliably. You should also use "$_SESSION = array();" to unset all the session vars before calling session_destroy().

If you are setting and accessing the sess_vars through the sess array (as you are - good thing) you can not use session_register() and session_unset() as you will get unpredictable results.

Have a look and try this simple session code -

<?php
session_start();

if (isset($_GET['reset'])) {
	unset($_SESSION['count']);
	}

if (!isset($_SESSION['count'])) {
	$_SESSION['count'] = 0;
	echo 'Just registered var';
	echo '<br><a href="'.$_SERVER['PHP_SELF'].'">Increment</a>';
	}
else {
	$_SESSION['count']++;
	echo 'Count: '.$_SESSION['count'];
	echo '<br><a href="'.$_SERVER['PHP_SELF'].'">Increment</a>';
	echo '<br><a href="'.$_SERVER['PHP_SELF'].'?reset=1">Reset</a>';
	}
?>

4. You must use session_start() on every page on which you wish to access your session variables.

jassh

hiya fellas...

first of all, thanks to nnichols...
it really explain this whole session thing..
which is very important i guess
if i want to create any type of 'cookie-free' login system...

anyway.. just a few more curiosity..

I now know that using session_destroy();
can physically delete my session file in the temp folder..
How do i make my application to destroy the session file
(the tmp file) in the /tmp folder,
even if the user does not log out,
but close their browser insted..
i found out that, yes, they cant login because the session is diffrent, but then, the old tmp file still exist...
is there any way to solve this, or there's nothing i can do about it?

secondly, i read in some books, they uses the
session_register("myvar"); and then they can actually just
write $myvar if they want to use the registered variable.
How diffrent does this from the $session['myvar'].
I found out that i cant use the same concept,
like having to type $myvar to resembles $session['myvar'].
But i guess this has to something to do with the Register Global thingy.. right? (mine are off by default).
I uses the $_SESSION method because
that is what i read in the manual..
and it is highly recomended by it...

anyway, thanks for your time..
looking foward for some reply...

thanks in advanced..
have a nice day...

-jassh

nnichols

You don't need to worry about the session files being left in your tmp directory. They will (hopefully) be cleaned up by php's garbage collection routines.

In your php.ini you might have noticed the following 2 directives -

; Percentual probability that the 'garbage collection' process is started
; on every session initialization.
session.gc_probability = 20

; After this number of seconds, stored data will be seen as 'garbage' and
; cleaned up by the garbage collection process.
session.gc_maxlifetime = 1800

gc_probability tells php how often to run the gc routines. If you set this to 100 then every time you make a call to session_start() php will check for expired session files and delete them. If your site is busy the default setting of 1 is best as you don't want the process being run for every sessioned page hit.

It is not the use of session_register() that makes the registered variable available as a global - it's the use of register_globals. It is better to code with globals off as it tends to lead to more robust code - though this is a point often debated on here. Keep using the super-global $_SESSION array.

Hope this makes sense 😉

jassh

hi there nnichols ...

thanks for da info...
it somehow made me understand the system..
and the things behind the scene that normally books wont tell..
i bet u must have been with php for quite some time allready..eh?

anyway...
i take your advice into accounts...
to use the $_SESSION array method,
rather than the session_register('var') stuff...
somehow i felt it is much more versatile...

i'm off to make my first mini application for all that i've learn here..
(it's a motorcycle parts tracking system for my bike,
since i want to keep track all the money used repairing it,
and also the lifespan of a part.. 🙂

thanks for the advice pal...
i hope you have a nice day ahead of you...
thanks again..

-jassh