bradgrafelman;11000014 wrote:
Oh dear, excellent point - thanks for reminding me. I forgot to mention...
Because you're using non-default parameters for the session in this web application (e.g. you're calling functions that set-up the session before you do session_start()) without using a non-default session name, you may experience interference with other applications that do use the default session parameters (e.g. they simply call session_start()).
To prevent this, you need to do one of the following:
Adopt your changes "site-wide" by altering the default value of the PHP directives prefixed with "session." that correspond to the new parameter values you're using. In other words, since you're only changing the cookie lifetime (I'm assuming you've already handled the session.gc_maxlifetime directive as noted earlier?), you'd want to modify the session.cookie_lifetime PHP directive.
Use a unique (non-default) name for the session used by your current application.
Also note that if you stick with setting the options manually (e.g. via calling session_set_cookie_params() before calling session_start()), then you'll want to make sure you do this on each PHP script that contains session_start().
okay, so going with the number 2 option:
I have this now:
session_set_cookie_params(2592000);
session_name('test_mysearches');
session_start();
// setcookie(session_name(),session_id(),time()+$lifetime);
$rqstsignature = md5($_SERVER['REQUEST_URI'].$_SERVER['QUERY_STRING'].print_r($_POST, true));
if(!isset($_SESSION['mysearches'])) {
$_SESSION['mysearches'] = array($_GET['s']);
} else {
if ($_GET['s'] != '') {
$_SESSION['mysearches'] = array_filter($_SESSION['mysearches'], 'strlen');
if ($_SESSION['LastRequest'] != $rqstsignature) { // not a refresh
array_unshift($_SESSION['mysearches'], $_GET['s']);
$_SESSION['LastRequest'] = $rqstsignature;
while(count($_SESSION['mysearches']) > 5) {
array_pop($_SESSION['mysearches']);
}
}
}
}
I show this in the live http header tool now:
Set-Cookie: test_mysearches=3f09e483004e91df3181f6d39b890c86; expires=Wed, 25-Apr-2012 19:32:20 GMT; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=30, max=50
on the set cookie line it does show Apr 25, so that is good...
Is the Keep-Alive something I need to worry about?
I have no idea if there any other places where session_start() is called. I don't know if wordpress sets up anything but i haven't done this anywhere else. But I will see if I can search thru to make sure..
IF I do opt for option 1, this would only affect this specific site. so something like this would be right:
ini_set('session.gc_maxlifetime', 86400 * 30);
session_set_cookie_params(2592000);
session_start();
$rqstsignature = md5($_SERVER['REQUEST_URI'].$_SERVER['QUERY_STRING'].print_r($_POST, true));
if(!isset($_SESSION['mysearches'])) {
$_SESSION['mysearches'] = array($_GET['s']);
} else {
if ($_GET['s'] != '') {
$_SESSION['mysearches'] = array_filter($_SESSION['mysearches'], 'strlen');
if ($_SESSION['LastRequest'] != $rqstsignature) { // not a refresh
array_unshift($_SESSION['mysearches'], $_GET['s']);
$_SESSION['LastRequest'] = $rqstsignature;
while(count($_SESSION['mysearches']) > 5) {
array_pop($_SESSION['mysearches']);
}
}
}
}
thanks again
