A thorough understanding of the php session mechanism

Session_start () is the beginning of the session mechanism. it has a certain probability to enable garbage collection, because the session is stored in the file,

I. default mechanism, using disk files for PHP sessions. Php. ini configuration: session. save_handler = files

1. session_start ()

A. session_start () is the beginning of the session mechanism. it has A certain probability to enable garbage collection because the session is stored in the file,

The garbage collection of PHP itself is invalid, and the collection of sessions is to delete files. this probability is determined based on the configuration of php. ini,

However, some systems use session. gc_probability = 0, which means the probability is 0, but garbage collection is implemented through the cron script.

Session. gc_probability = 1

Session. gc_divisor = 1000

Session. gc_maxlifetime = 1440 // The default expiration time is 24 minutes.

// The probability is session. gc_probability/session. gc_divisor. result 1/1000,

// It is not recommended to set too small because session garbage collection requires checking whether each file has expired.

Session. save_path = // It seems that different systems have different default values. one of them is set to "N;/path"

// This is a random hierarchical storage. in this case, garbage collection does not work and you need to write your own scripts.

B. The session checks whether $ _ COOKIE [session_name ()]; session_name () returns the COOKIE key value for saving session_id,

This value can be found in php. ini.

Session. name = PHPSESSID // Default value: PHPSESSID

C. If it does not exist, a session_id will be generated, and the generated session_id will be passed to the client as the COOKIE value.

The following COOKIE operation is performed. Note that the setcookie () operation is performed in this step, and the COOKIE is sent in the header,

No output is available before. PHP has another function session_regenerate_id (). If this function is used, no output is available before.

Setcookie (session_name (), session_id (), session. cookie_lifetime, // The default value is 0 session. cookie_path, // Default '/'. the current program and directory have valid sessions. cookie_domain, // null by default)

D. If session_id =$ _ COOKIE [session_name];

Go to the folder specified by session. save_path to find the file named 'sess _ '. session_id.

Read the file content deserialization and put it in $ _ SESSION.

2. assign a value to $ _ SESSION

For example, if a new value $ _ SESSION ['test'] = 'Blah' is added, this $ _ SESSION will only be maintained in the memory. when the script execution ends,

Write the $ _ SESSION value to the folder specified by session_id, and then close related resources. in this phase, you may change the session_id,

For example, destroy an old session_id and generate a new session_id. half of it is used for custom session operations and role conversion,

For example, if an anonymous user of Drupal. Drupal has a SESSION, the new session_id needs to be used after logon.

If (isset ($ _ COOKIE [session_name ()]) {setcookie (session_name (), ", time () 42000 ,'/'); // old session cookie expired} session_regenerate_id (); // This step generates a new session_id // session_id () returns a new value