PHP MySQL - Stilson.net

www.it-ebooks.infoCHAPTER 18 • SESSION HANDLERSsession_decode($sessionVars);echo "User ".$_SESSION['username']." logged on at ".$_SESSION['loggedon'].".";?>This returns:User jason logged on at Feb 16 2011 22:55:22.This hypothetical example is intended solely to demonstrate PHP’s session encoding and decodingfunction. If you would like to store session data in a database, there’s a much more efficient method thatinvolves defining custom session handlers and tying those handlers directly into PHP’s API. Ademonstration of this appears later in this chapter.Regenerating Session IDsAn attack known as session-fixation involves an attacker somehow obtaining an unsuspecting user’s SIDand then using it to impersonate the user in order to gain access to potentially sensitive information.You can minimize this risk by regenerating the session ID on each request while maintaining thesession-specific data. PHP offers a convenient function named session_regenerate_id() that willreplace the existing ID with a new one. Its prototype follows:boolean session_regenerate_id([boolean delete_old_session])The optional delete_old_session parameter determines whether the old session file will also bedeleted when the session ID is regenerated. By default, this behavior is disabled.Practical Session-Handling ExamplesNow that you’re familiar with the basic functions that make session handling work, you are ready toconsider a few real-world examples. The first example shows how to create a mechanism thatautomatically authenticates returning registered users. The second example demonstrates how sessionvariables can be used to provide the user with an index of recently viewed documents. Both examplesare fairly commonplace, which should not come as a surprise given their obvious utility. What may comeas a surprise is the ease with which you can create them.■ Note If you’re unfamiliar with the MySQL database and are confused by the syntax found in the followingexamples, consider reviewing the material found in Chapter 30.377