Analysis of cookies and sessions in PHP

1. PHP COOKIE
Cookie is a mechanism for storing data in a remote browser and tracking and identifying users.
PHP sends cookies in the http header. Therefore, the setcookie () function must be called before other information is output to the browser, which is similar to the header () function.
1.1 set cookie:
You can use the setcookie () or setrawcookie () function to set the cookie. You can also directly send an http header to the client.
.
1.1.1 use the setcookie () function to set the cookie:
Bool setcookie (string name [, string value [, int expire [, string path [, string domain [, bool secure [, bool
Httponly])
Name: cookie variable name
Value: the value of the cookie variable.
Expire: the end time of the validity period
Path: valid directory
Domain: Valid domain name, unique in top-level domain
Secure: If the value is 1, the cookie can only be valid on the https connection. If the default value is 0, both http and https can be used.
Example:
Code snippet
<〈? Php
$ Value = 'something from somewhere ';
Setcookie ("TestCookie", $ value );/*
Simple cookie settings
*/
Setcookie ("TestCookie", $ value, time () + 3600 );/*
Valid for 1 hour
*/
Setcookie ("TestCookie", $ value, time () + 3600, "/~ Rasmus/",
".Example.com", 1 );/*
Valid directory
/~ Rasmus,
Valid Domain Name
Example.com
And all its subdomains
*/
? > 〉
Set multiple cookie variables: setcookie ('var [a] ', 'value'); use an array to represent variables, but its subscript is not enclosed in quotation marks. In this way, you can use $ _ COOKIE ['var'] ['a'] to read the COOKIE variable.
1.1.2. Use header () to set the cookie;
Header ("Set-Cookie: name = $ value [; path = $ path [; domain = xxx.com [;...]");
The following parameters are the same as those of the setcookie function listed above.
For example:
Code snippet
$ Value = 'something from somewhere ';
Header ("Set-Cookie: name = $ value");
1.2 Cookie reading:
Directly use php's built-in Super global variable $ _ COOKIE to read the cookie on the browser side.
In the preceding example, the cookie "TestCookie" is set. Now let's read:
Code snippet
Print $ _ cookie ['testcooker'];
Is the cookie output ?!
1.3 Delete a cookie
Set the effective time to less than the current time, and set the value to null. For example:
Code snippet
Setcookie ("name", "", time ()-1 );
Similar to Header.
1.4 troubleshooting:
1) An error message is prompted when setcookie () is used, probably because there is an output or space before setcookie () is called. Or your document may be converted from other character sets. The document may be followed by a BOM signature (that is, add some hidden BOM characters to the file content ). The solution is to prevent this problem from occurring in your documents. You can also use the ob_start () function.
2) $ _ cookie is affected by magic_quotes_gpc and may be automatically escaped.
3) it is necessary to test whether the user supports cookies.
1.5 cookie working mechanism:
Some learners are impulsive and have no idea about the principle, so I will put it behind me.
A) the server sends an HTTP set-Cookie header in response and sets a cookie in the client (multiple cookies require multiple heads ).
B) The client automatically sends an HTTP cookie header to the server, and the server receives and reads the cookie.
HTTP/1.x 200 OK
X-powered-by: PHP/5.2.1
Set-COOKIE: testcookie = something from somewhere; Path =/
Expires: Thu, 19 Nov 2007 18:52:00 GMT
Cache-control: No-store, no-cache, must-revalidate, post-check = 0, pre-check = 0
Pragma: No-Cache
Content-Type: text/html
This line implements the cookie function. After receiving this line, set-COOKIE: testcookie = something from somewhere; Path =/
The browser will create a cookie file on the disk of the client, and write:
Testcookie = something from somewhere;
/
This line is the result of using setcookie ('testcookie ', 'something from somewhere. That is, the result of using header ('set-COOKIE: testcookie = something from somewhere; Path =.
2. PHP session
The session uses a cookie with the expiration time set to 0, and uses a unique identifier (a long string) called the session ID ), generate some session files synchronously on the server side (you can define the session storage type by yourself) and associate them with the user machine. Web applications store data related to these sessions, and transmit data between pages as users.
Visitors to the website will be assigned a unique identifier, the so-called session ID. It is either a cookie stored on the client or transmitted through a URL.
The session allows the user to register any number of variables and keep them for use by each request. When visitors visit the website, PHP will automatically (if session. auto_start is set to 1) or check whether a specific session ID is sent in the request (explicitly called by session_start () or secretly called by session_register. If yes, the previously saved environment is rebuilt.
2.1 transfer session ID
2.1.1 send session ID through cookie
Use session_start () to call the session. When the server generates the session file, it generates the session ID hash value and the session name with the default value PHPSESSID, and sends the variable (default) to the client) PHPSESSID (Session name), with a 128-bit hash value. The server uses this cookie to interact with the client.
The session variable value is serialized in PHP and stored in a text file on the server. It interacts with the coolie whose client variable name is PHPSESSID by default.
That is, the server automatically sends the HTTP header: Header ('set-COOKIE: session_name () = session_id (); Path =/'); that is
Setcookie (session_name (), session_id ());
After you jump to a new page from this page and call session_start (), PHP checks the session data stored on the server that is associated with the given ID. If no session data is found, a new dataset is created.
2.1.2 send session ID through URL
This method is used only when the user disallows the use of cookies, because the browser cookie is already used. This method is not required for security purposes.
<A href = "p. php? <〈? Php print session_name ()? >= <〈? Php print session_id ()? > "> Xxx </a>, you can also pass the session value through POST.
2.2 Basic session usage example
Code snippet
<〈? Php
// Page1.php
Session_start ();
Echo 'Welcome to page #1 ';
/*
Create a session variable and assign a value to the session variable
*/
$ _ SESSION ['favcolor'] = 'green ';
$ _ SESSION ['animal '] = 'cat ';
$ _ SESSION ['time'] = time ();
//
If the client uses cookies, the session can be directly transferred to page2.php.
Echo '<br/> <a href = "page2.php"> page 2 </a> 〉';
//
If the client disables cookie
Echo '<br/> <a href = "page2.php? '. SID.'> page 2 </a> 〉';
/*
By default, in php5.2.1, SID only has a value when the cookie is written. If the cookie corresponding to this session already exists, the SID will be
(
Undefined
)
Null
*/
? > 〉
Code snippet
<〈? PHP
// Page2.php
Session_start ();
Print $ _ session ['animal ']; // print a single session
Var_dump ($ _ session); // print the session value passed by page1.php.
? > 〉
2.3 use the session function to control page Cache
In many cases, we need to determine whether our webpage is cached on the client or set the cache validity period. For example, we need to log on to the webpage to view some sensitive content, if the cache is cached locally, you can directly open the local cache to browse the webpage without logging on.
Use session_cache_limiter ('private'); to control the page client cache, which must be called before session_start. For more parameters, see http://blog.chinaunix.net/u/27731/showart.php? Client Cache Control with ID = 258087.
Use session_cache_expire (INT) to control the Client Cache Time. Unit: (s ). It must also be called before session_start.
This is only a method for controlling the cache when session is used. We can also control the page cache in Header.
2.4 delete a session
Three steps are required.
Code snippet
<〈? PHP
Session_destroy ();//
Step 1:
Delete the session file on the server.
Setcookie (session_name (), '', time ()-3600 );//
Step 2:
Delete the actual session:
$ _ SESSION = array ();//
Step 3:
Delete the $ _ SESSION global variable array
? > 〉
2.5 session usage in PHP large-scale web Applications
The default session storage method is not suitable for websites with large traffic volumes. Currently, the optimal method is to access sessions using databases. In this case, the function bool session_set_save_handler (callback open, callback close, callback read, callback write, callback destroy, callback gc) is the solution to solve this problem.
The function uses the following six functions:
1. bool open () is used to open the session storage mechanism.
2. bool close () closes the session storage operation.
3. This function is used when mixde read () loads session data from the storage.
4. bool write () writes all data of the given session ID to the storage.
5. bool destroy () destroys the data associated with the specified session ID.
6. bool gc () collects junk data in the storage system.
For example, see the session_set_save_handler () function in the php manual.
If you use classes for processing, use code snippets.
Session_set_save_handler (
Array ('classname', 'open '),
Array ('classname', 'close '),
Array ('classname', 'read '),
Array ('classname', 'write '),
Array ('classname', 'deststroy '),
Array ('classname', 'gc '),
)
Call six static methods in the className class. ClassName can instantiate objects without calling static methods, but static members do not need to generate objects, which provides better performance.
2.6 common session functions:
Bool session_start (void) initializes the session.
Bool session_destroy (void) deletes the session associated files on the server.
String session_id () indicates the id of the current session.
String session_name () indicates the name of the session currently accessed, that is, the cookie name used by the client to save the session ID.
Recognize PHPSESSID.
Array session_get_cookie_params () details of the session associated with this session.
String session_cache_limiter () controls the client cache for pages that use sessions.
Ini session_cache_expire () controls the Client Cache Time.
Bool session_destroy () deletes the file on the server that stores session information.
Void session_set_cookie_params (INT lifetime [, string path [, string domain [, bool secure [, bool
HTTPOnly]) sets the details of the session associated with this session.
Bool session_set_save_handler (callback open, callback close, callback read, callback write, callback
Destroy, callback GC) defines the function for processing the session (instead of using the default method ).
Bool session_regenerate_id ([bool delete_old_session]) allocates a new session ID
2.7 Session Security Problems
By investing a lot of energy, attackers try to obtain the Valid Session ID of an existing user. With the session ID, they may be able to have the same capabilities as this user in the system.
Therefore, our main solution is to verify the validity of the session ID.
Code snippet
<〈? PHP
If (! Isset ($ _ session ['user _ agent']) {
$ _ Session ['user _ agent'] = $ _ server ['remote _ ADDR '].
$ _ Server ['HTTP _ user_agent '];
}
/*
If the session ID is forged
*/
Elseif ($ _ SESSION ['user _ agent']! = $ _ SERVER ['remote _ ADDR '].
$ _ SERVER ['HTTP _ USER_AGENT ']) {
Session_regenerate_id ();
}
? > 〉
2.8 if the Session is passed through cookie and the session passed through SID is different from the default configuration of the session in php5.2.1, when the Session is generated, the server generates a pre-defined super global variable SID when sending headerset-cookie (that is, writing a cookie is equivalent to throwing a SID ), when $ _ COOKIE ['phpsessid '] exists, no cookie is written or the super global variable SID is generated. At this time, the SID is empty.
2.9 session instance
Code snippet
<〈? Php
/**
* Verify the validity of the session *
*/
Function sessionVerify (){
If (! Isset ($ _ SESSION ['user _ agent']) {
$ _ SESSION ['user _ agent'] = MD5 ($ _ SERVER ['remote _ ADDR ']
. $ _ SERVER ['HTTP _ USER_AGENT ']);
}
/* If the user's session ID is forged, re-allocate the session ID */
Elseif ($ _ SESSION ['user _ agent']! = MD5 ($ _ SERVER ['remote _ ADDR ']
. $ _ Server ['HTTP _ user_agent ']) {
Session_regenerate_id ();
}
}
/**
* Destroy a session *
Perfect implementation in three steps *
*/
Function sessiondestroy (){
Session_destroy ();
Setcookie (session_name (), '', time ()-3600 );
$ _ Session = array ();
}
? > 〉
Note:
The cause of the session header message being sent is the same as that of the cookie.
In PhP5, the Registry configuration options of all PHP sessions are configurable during programming. In general, we do not need to modify the configuration. For more information about PHP session registry configuration options, see session processing functions in the manual.