Where to locate "tmp" directory for session.save_handler

bunner_bob

I'm using the line "ini_set('session.save_handler', 'files');" before session_start(); in my files, and understand I should have a directory called "tmp" (world writeable?) somewhere in my filesystem.

Sessions are created and used both by files within public_html and by files within the admin subdirectory. Sessions are not considered to persist between the two directories - if you're logged in as an admin, you're not logged in as a public user, and vice versa.

This is on a shared host, by the way.

The account's directory structure looks like this:
username
public_html
index.php
(other php files, image folders, etc)
admin
index.php
(other php files, etc. related to admin)

My question is, where should I locate the tmp directory?

inside "username" (i.e. outside the public_html directory)?
inside "public_html"?
a separate, additional tmp directory inside "admin" for admin logins?

Thanks!

sneakyimp

ideally, this tmp folder location would be
a) outside of your public_html directory so folks can't just point a browser to it, hoping to take a peek at somebody's session info.
b) somewhere where other users of the same shared hosting system also cannot spy on your session files.

i'm not super familiar with using ini_set on that particular parameter. i have, however, written some code to use a database as a session data handler. i think you'll need to refer to the absolute path to the folder...something like

/home/username/tmp

or something like that.

i hope this is helpful.

sneakyimp

PS: the folder will need to have the correct read/write permissions so that apache (or whatever program needs access) can create new files in that folder. on a shared hosting system, it is not always possible to change the permissions on folders so you may need some help from your sysadmin.

bunner_bob

Should I have a trailing slash after .../tmp ?

sneakyimp

try doing an ini_get first and see if the existing value has one. or run phpinfo() and see if the existing value has one. or read the documentation?

cgraz

if the document root to your public_html folder is

/home/bunner_bob/public_html

then create a directory just outside of public_html called bsessions (for example) and make it writable. Then use

session_save_path( '/home/bunner_bob/bsessions' );

to use that directory as your session store. Don't use the default tmp directories on shared hosts.

bunner_bob

Actually I created a tmp directory inside the user account, and added a line to the main .htaccess file:

php_value session.save_path /usr/home/bunner_bob/tmp