How to keep the session in PHP and some thought _php tutorial

what is a session?

As explained by the wiki, the session is an interactive message that exists between two communication devices, established at a certain time, and fails after a certain amount of time. Common sessions are: TCP session, WEB session (HTTP session), LOGIN session, and so on.

According to the OSI model, the sessions are implemented in different locations, the session is divided into several, one is the application layer session, including the Web session (HTTP session) and Telnet Telnet session, the session layer is implemented, including sessions Initiation Protocol (SIP) and Internet Phone Call, there is a TCP SESSION implemented at the transport layer.

This article mainly discusses the web session, which generally have two kinds: client session and server side session, the latter is the most common Java beans provided.

What does the session do?

In the computer field, especially in the network, the session is used in a very wide range, also can be called Dialogue (dialogue), conversation, etc., generally refers to the two communication devices stored between the state, and sometimes occurs between the user and the computer (Login SESSION).

Unlike stateless communication, the session is typically used to store communication states, so that at least one party in the communication needs to store the history of the session, thus enabling communication between the two.

How does the session (WEB session) be implemented?

When HTTP communication occurs between the browser and the server, it usually contains an HTTP Cookie to identify the state, usually with a unique SESSIONID, and the session usually records some of the user's authentication information and levels.

The most commonly used HTTP Session token in several programming languages is Jsessionid (JSP), Phpsessid (PHP), ASPSessionID (ASP), which is typically generated by a hash function that uniquely represents the user's identity, When the server communicates with the client, it is stored as a GET or post parameter on the client.

There are two ways to implement a session, server-side session and client session, both of which have advantages and disadvantages.

The server-side session is easy and efficient, but when it comes to load balancing or high availability requirements, it is difficult to deal with, and is not available when there is no storage device in the native system. Load balancing can be achieved by sharing a file system or forcing a client to log on to only one server, but this reduces efficiency. For devices that do not have storage, you can also use RAM (refer to reference 6) to resolve server-side session implementations, which are valid for systems that have limited client links (such as routing or access point devices).

The use of the client session can solve some problems of server-side session, such as avoiding the load balancing algorithm, but at the same time will produce some of their own problems. The client session uses cookies and encryption techniques to save state between different requests. At the end of each dynamic page, the current session is counted and sent back to the client. After each successful request, the cookie is sent back to the server to let the server "Remember" the user's identity. Client session The most important issue is security, and once the cookie is hijacked or tampered with, the security of the user's information is lost.

How do I set the session in PHP?

After setting up the PHP development environment, you can view the session-related sections through Phpinfo (), including:

Session module, in PHP V5.2.9 version, a total of 25 variables. Among them, the usual set of regular use of several are:

Session.cookie_lifetime Setting the cookie expiration time for storage SessionID

Session.name Session cookie Name, default is PHPSESSID

Session.save_handler session storage mode, default to File

Session.save_path fedora is stored by default in/var/lib/php/session

Session.gc_probability

Session.gc_divisor

Session.gc_maxlifetime these three options to handle the probability of the GC mechanism occurring

Session.cache_limiter (Nocache,private,private_no_expire,public)

Session.cache_expire These two options are the pages used to cache the session

First of all, consider the first question, how long the session will expire, how did he expire? If you want to use the session in a PHP program, you must first refer to Session_Start (), the function is executed, it will be stored in the Session directory (if you use file handler) to generate a session file, the contents are empty, At the same time, the browser meets a cookie named Phpsessid, which stores the name of a hash session.

The expiration of the session depends on a garbage collection mechanism (garbage Collection), after the session is created as a file on the server, the client script each access to the session variable, session file access time will be updated. Each access is based on the client storage SessionID to request the server to store the unique session, when the client's cookie expires, there is no way to know which session to access, although the session file on the server has not been expired back, This can cause a waste of server resources.

But at the same time, if we want the user's session to expire immediately, we can do so by setting a cookie. Session recycling is done every time the page is visited, the probability of recycling is specified by Session.gc_probability,session_gc_divisor, the default is 1/100. If set to 1, the session must be reclaimed each time it exceeds the lifetime of the session to access it.

Two requirements: 1, PHP to maintain the session or extend the session expiration time, 2, so that the session expires immediately.

1, it is necessary to keep the session in PHP and extend the session expiration time, especially in the internal application system or with a large form. Think of your boss in filling out a form, just meet lunch time, keep this form and so eat back, fill out the remaining content, submitted after he saw what, generally speaking is a login interface. To improve the user experience, the key is to make the boss's form a problem, we must extend the session's life cycle.

It is possible to set Session.gc_maxlifetime to keep the session from expiring and extending the session expiration time in PHP, but first you need to ensure that the client's cookie does not expire before the GC performs the collection. By setting a longer gc_maxlifetime, you can extend the lifetime of the session, but for applications that are not always long-lasting, this is obviously not the best choice for a server configuration.

We know that the session's recovery mechanism is based on the last access time of the session file, and if it exceeds the maxlifetime, it is recycled according to the probability of recovery. So we just have to visit the session on a regular basis, and this can be done by refreshing the page, according to this idea, the solution is there.

To visit the page by JS regularly;

Use the IFRAME to refresh the page periodically;

The direct use of the program to send HTTP requests, so as to avoid embedding other elements in the page;

The following is the implementation of the hold session implementation using JS send request, so that we only need to maintain a long session of the page (such as large form page).

 
  
  

  
   
   
 
  
   
   
 "Phpimg" src= "http://www.phpplot.com/phpplot/session/sess_refresh.php?" width= "1" height= "1"
 
  
  

The URL after which a random number is added is to avoid this link request is cached by the browser.

2, so that the session immediately expires the method is more, we can Session_destroy (), can also use the above ideas, request a Session_destroy page.

Is the session safe?

The PHP Handbook explicitly writes: The session does not guarantee that the information stored in the session must be seen by his creator.

If you want to handle some remote operations safely, then HTTPS is the only option. Most basic, do not think that a user information in the session exists that the user must be himself, although the session of the information will give you he has been through the user name and password Authentication illusion. So, if you need to do some change password or similar things, let the user re-enter the password is a better choice.

Earlier versions of Apache did not use cookies to store PHPSESSID, but instead used the Url-rewrite, which, after each URL, would add phpsessid= to indicate that it belonged to the active session. The new version of Apache has set this property to off by default.

session.use_trans_id = 0;

So in this sense, extending the session for too long or keeping the session online is never a good thing for security. The ultimate solution is the user commits to jump to the login window, log in and back to fill the page, and all the data are still there. This implementation is now using AJAX to solve it should be no difficulty, every time at a certain point in the current user data post to a storage location, whether it is XML or JSON.

Keep session supplements in PHP:

You can use the method for scenarios where the client does not support javascript:

1, write a floating layer, shown in the topmost layer, if the user did not disable JS, then let the floating layer disappear;

2, all the input is set to disable, and then use JS set to Enabled;

Both of these methods are in the JS is disabled, all the functions are not available, how to use JS is disabled to make our application still working normally, this seems to be more difficult. The time it takes to achieve this and the effect you receive are weighed down.

http://www.bkjia.com/PHPjc/446605.html www.bkjia.com true http://www.bkjia.com/PHPjc/446605.html techarticle what is a session? As explained by the wiki, the session is an interactive message that exists between two communication devices, established at a certain time, and fails after a certain amount of time. The common session is: T ...

