PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Implementing Authentication with Session Control
517
Table 23.1 Continued
Option Name Default Effect
session.name PHPSESSID Sets the name of the session that is used as
the cookie name on a user’s system.
session.save_handler files Defines where session data is stored.You can
set this option to point to a database, but
you have to write your own functions.
session.save_path "" Sets the path where session data is stored.
More generally, sets the argument passed
to the save handled and defined by
session.save_handler.
session.use_cookies 1 (enabled) Configures sessions to use cookies on the
client side.
session.cookie_secure 0 (disabled) Specifies whether cookies should only be
sent over secure connections.
session.hash_function 0 (MD5) Allows you to specify the hash algorithm
used to generate the session IDs.“0” means
MD5 (128 bits) and ‘l’ means SHA-1 (160
bits). This configuration setting was introduced
in PHP 5.
Implementing Authentication with Session
Control
Finally, we look at a more substantial example using session control.
Possibly the most common use of session control is to keep track of users after they
have been authenticated via a login mechanism. In this example, you combine authentication
from a MySQL database with use of sessions to provide this functionality.This
functionality forms the basis of the project in Chapter 27,“Building User Authentication
and Personalization,” and will be reused in the other projects.You will reuse the authentication
database you set up in Chapter 17,“Implementing Authentication with PHP and
MySQL.”You can check Listing 17.3 in that chapter for details of the database.
The example consists of three simple scripts.The first, authmain.php, provides a login
form and authentication for members of the website.The second, members_only.php,
displays information only to members who have logged in successfully.The third,
logout.php, logs out a member.
To understand how this example works, look at Figure 23.4, which shows the initial
page displayed by authmain.php.