Session Continuation

fnbcprog

I have a small dilemma. I am programming an online classifieds program and I want to incorporate a user management system. I run into a small problem however.

If i am trying to print something like "Welcome back John Smith" I have to start a session to retrieve the $_SESSION array. Which means I have to call session_start() at the top of every page whether or not the client even has a user account or is logged in.

What i want to do is figure someway to avoid calling session_start() and creating a session with a user that is just browsing the website. I was thinking about maybe dropping a cookie onto the users machine but that is not reliable enough since cookies cannot always be accepted by clients.

Does anyone have any ideas about this?

AstroTeg

Cookies.

They come to the site and you read their cookie. From the cookie info, you can reload their session info (ideally from a DB or something).

If they don't have cookies, then they're kind of stuck. They'll have to log back in (if they don't have cookies, then they should know that sites won't be able to remember them and they'll have to log in again).

The only thing I can think of is you do some URL tricks and you have them save the URL as a bookmark, but I'm not sure that's a desired user experience.

fredouille

you can make sessions in the database with an ip list to recognize people...avoid cookies it is cheatable

Shrike

And what about those people who have dynamically assigned IP's? 🙂

Cookies are 'cheatable' how?

fredouille

Originally posted by Shrike
And what about those people who have dynamically assigned IP's? 🙂

Cookies are 'cheatable' how?

yes you are fucked

you can ask for login before adding to cart

cookie are cheatable because you can send what you want like by get...

AstroTeg

IPs can be forged and organizations tend to use 1 IP for all their outbound 'net traffic. So if user A from company X logs in, you'd be passing user A's info to user B at company X. Not a good thing to do, if you ask me.

Cookies can be defeated, but there's a lot more effort involved (and this effort is usually by those who wish to defeat your system).

Shrike

Cookies are only as cheatable as you allow them to be. What the hell has $_GET got to do with cookies?

AstroTeg

Originally posted by fredouille

cookie are cheatable because you can send what you want like by get...

I'd say just put an identifier in the cookie and validate that identifier against a session variable or something. Don't be putting sensitive stuff in the cookie and the problem is solved...

Shrike

What Astro said 🙂

slak

Simple answer really.

Don't store sensitive information in cookies.

People's forenames and surnames aren't really that sensitive information in my opinion so I see no reason why you shouldn't store them in a cookie if that is the course of action you choose to take.

You could disregard cookies altogether and have the user log-in before displaying your friendly message. This would be session based.

Using IP addresses to track users is plain silly unless it's on a static IP based Intranet.

Shrike

Fair enough, although how can you use sessions without using cookies (or appending phpsessid to the URL) ?

AstroTeg

Without cookies, you would have to have the session ID appended to the URL. Or buckle in to posting data to all your pages (tried this once for giggles - it wasn't a lot of fun).

Shrike

Before I used sessions I used to pass data around with hidden fields. I keep doing it too, even though all the while I'm thinking "I could just put this in the session...whole lot easier".

fnbcprog

So basically i should drop a cookie when they login and save there name to the cookie....How do i go about saving information to the database for session tracking?

Isnt the session id destroyed after the user closes the page. Or does the server hold on to all session variables and id until i call session_destroy()?

If it holds the information how do I call a session based on their old session id in the cookie for instance?

Thanks for all the hints and tips it is greatly appreciated!!!

AstroTeg

Sessions are timed out and cleaned up, even if you don't call session_destroy() (session_destroy() just forces the cleanup before its time).

All a session is is a means for PHP to save some arbitrary data to a file and has a way to call it back without you having to do a lot of work. With a database, you have some more work involved but also much more control of the data. You don't have to use a database, but you might find its easier to manage then a file. And you'd want to load up the session by retrieving the session info you saved previously (these are do-it-yourself type functions) and putting it in the new session you create.

fnbcprog

so basically i should have the data drop into a table when they login and drop a cookie with lets say the user_id.

upon reentry query the server for that user_id and then load up the session variables before page displays. If there is no information in the table then that have logged out previously?

What would you call that table? temp something maybe??

AstroTeg

You just about have it. I'd lean towards storing something different then an ID (in theory, someone could change the ID in the cookie and become someone else).

As for the name, it can be anything you like. Although since you're treating it as session storage, you might think about adding "session" or something that will trigger the thought of a session in the table name.

fnbcprog

what information should i store in the cookie to reference the temp table in order to gain the old session information??

it has to be somekind of unique value?

AstroTeg

It needs to be unique enough for you to pull out their info. I've used IDs in the past. But an auto number ID is pretty easy to guess at. A better approach might be to produce a more random looking number/ID. One thought is to use the actual session ID. Another thought is to use the md5() function (maybe hash the first and last name or email address or something and then store the hash in the database and the cookie).

fnbcprog

I gotcha and i think i got it working!!! Thanx for all the help!!!!!!