Phpsession and cookie usage instructions. For more information, see. 1. PHP COOKIE
Cookie is a mechanism for storing data in a remote browser and tracking and identifying users. PHP sends cookies in the http header. Therefore, the setcookie () function must be called before other information is output to the browser, which is similar to the header () function. 1.1 Set cookie:
You can use the setcookie () or setrawcookie () function to set the cookie. You can also set it by sending an http header directly to the client.
1.1.1 Use the setcookie () function to set the cookie:
Bool setcookie (stringname [, stringvalue [, int expire [, stringpath [, stringdomain [, bool secure [, bool httponly])
Name: cookie variable name value: cookie variable value expire: the end time of the validity period,
Path: valid directory,
Domain: valid domain name, the only secure of the top-level domain: if the value is 1, the cookie can only be valid on the https connection. if the default value is 0, both http and https can be used.
Example:
The code is as follows:
$ Value = 'something from somewhere ';
Setcookie ("TestCookie", $ value );
/* Simple cookie setting */setcookie ("TestCookie", $ value, time () + 3600);/* valid for 1 hour */setcookie ("TestCookie", $ value, time () + 3600 ,"/~ Rasmus/"," .example.com ", 1);/* valid directory /~ Rasmus, valid domain name example.com and all its subdomains */
?>
Set multiple cookie variables: setcookie ('Var [a] ', 'value'); use an array to represent variables, but its subscript is not enclosed in quotation marks. in this way, you can use $ _ COOKIE ['var'] ['A'] to read the COOKIE variable.
1.1.2. use header () to set the cookie;
Header ("Set-Cookie: name = $ value [; path = $ path [; domain = xxx.com [;]");
The following parameters are the same as those listed in the setcookie function above.
For example:
The code is as follows:
$ Value = 'something from somewhere ';
Header ("Set-Cookie: name = $ value ");
1.2 Cookie reading:
Directly use php's built-in Super global variable $ _ COOKIE to read the cookie on the browser.
The cookie "TestCookie" is set in the preceding example. now we can read:
Print $ _ COOKIE ['testcooker'];
Is the COOKIE output ?!
1.3 Delete a cookie
Set the effective time to less than the current time, and set the value to null. for example:
Setcookie ("name", "", time ()-1 );
Similar to header.
1.4 Troubleshooting:
1) an error message is prompted when setcookie () is used, probably because there is an output or space before setcookie () is called. it is also possible that your document is converted from other character sets. the document may be followed by a BOM signature (that is, add some hidden BOM characters to the file content ). the solution is to prevent this problem in your document. you can also use the ob_start () function to handle this problem.
2) $ _ COOKIE is affected by magic_quotes_gpc and may be automatically escaped. 3) it is necessary to test whether users support cookies.
1.5 cookie working mechanism:
Some learners are impulsive and have no idea about the principle, so I put it behind me.
A) the server sends an http Set-Cookie header in response and sets a cookie in the client (multiple cookies require multiple heads ).
B) the client automatically sends an http cookie header to the server, and the server receives and reads the cookie.
HTTP/1.x 200 OK
X-Powered-By: PHP/5.2.1
Set-Cookie: TestCookie = something from somewhere; path =/
Expires: Thu, 19 Nov 2007 18:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check = 0, pre-check = 0
Pragma: no-cache
Content-type: text/html
This line implements the cookie function. after receiving this line, Set-Cookie: TestCookie = something from somewhere; path =/
The browser will create a cookie file on the disk of the client, and write:
TestCookie = something from somewhere;
This line is the result of using setcookie ('testcookie ', 'Something from somewhere. that is, the result of using header ('set-Cookie: TestCookie = something from somewhere; path =.
2. PHP Session
The session uses a cookie with the expiration time set to 0, and uses a unique identifier (a long string) called the session ID ), generate some session files synchronously on the server (you can define the session storage type by yourself) and associate them with the user machine. web applications store data related to these sessions, and transmit data between pages as users.
Visitors to the website will be assigned a unique identifier, the so-called session ID. It is either a cookie stored on the client or transmitted through a URL. Session support allows users to register any number of variables and keep them for use by each request. When visitors visit the website, PHP will automatically (if session. auto_start is set to 1) or when a user request (explicitly called by session_start () or secretly called by session_register () checks whether a specific session ID is sent in the request. If yes, the previously saved environment is rebuilt. 2.1 sessionID transfer 2.1.1 send sessin ID through cookie
Use session_start () to call the session. when the server generates the session file, it generates the session ID hash value and the session name with the default value PHPSESSID, and sends the variable (default) to the client) PHPSESSID (session name), with a 128-bit hash value. the server will use this cookie to interact with the client.
The session variable value is serialized in php and stored in a text file on the server. it interacts with the coolie whose client variable name is PHPSESSID by default.
That is, the server automatically sends the http header: header ('set-Cookie: session_name () = session_id (); path = /');
That is, setcookie (session_name (), session_id ());
After you jump to a new page from this page and call session_start (), PHP checks the session data stored on the server that is associated with the given ID. If no session data is found, a new dataset is created.
2.1.2 send session ID through URL
This method is used only when the user disallows the use of cookies, because the browser cookie is already used. this method is not required for security purposes.
= "> Xxx, you can also pass the session value through POST.
2.2 Basic session usage example
The code is as follows:
// Page1.php
Session_start ();
Echo 'Welcome to page #1 ';
/* Create a session variable and assign a value to the session variable */$ _ SESSION ['favcolor'] = 'green ';
$ _ SESSION ['Animal '] = 'cat ';
$ _ SESSION ['Time'] = time ();
// If the client uses cookies, the session can be directly transferred to page2.php.
Echo'
Page 2 ';
// If the client disables cookie
Echo'
Page 2 ';
/*
By default, in php5.2.1, SID only has a value when the cookie is written.
The corresponding cookie already exists, so the SID will be (undefined) blank */
?>
// Page2.php
Session_start ();
Print $ _ SESSION ['Animal ']; // print a single session
Var_dump ($ _ SESSION); // Print the session value passed by page1.php.
?>
2.3 use the session function to control page cache.
In many cases, we need to determine whether our webpage is cached on the client or set the cache validity period. for example, we need to log on to the webpage to view some sensitive content, if the cache is cached locally, you can directly open the local cache to browse the webpage without logging on.
Use session_cache_limiter ('private'); to control the page client cache, which must be called before session_start.
For more parameters, see http://blog.chinaunix.net/u/27731/showart.php? Client cache control with id = 258087.
Use session_cache_expire (int) to control the client cache time; unit (s). it must also be called before session_start.
This is only a method for controlling the cache when session is used. we can also control the page cache in header.
2.4 delete a session
Three steps are required.
Session_destroy (); // Step 1: delete the session file on the server, which uses setcookie (session_name (), '', time ()-3600); // Step 2: delete the actual session:
$ _ SESSION = array (); // Step 3: delete the $ _ SESSION global variable array?>
2.5 The use of sessions in PHP large-scale web applications is not suitable for websites with high access volumes using the default session storage method. Currently, the optimal method is to use databases to access sessions. at this time, the function bool session_set_save_handler (callbackopen, callbackclose, callbackread, callbackwrite, callbackdestroy, callbackgc) is the solution to solve this problem.
The function uses the following six functions:
1. bool open () is used to open the session storage mechanism,
2. bool close () closes the session storage operation.
3. this function is used when mixde read () is installed in session data from the storage. 4. bool write () writes all data of the given session ID to the storage. bool destroy () destroys the data associated with the specified session ID. 6. for the example of garbage collection of data in the storage system by bool gc (), see The php manual session_set_save_handler () function.
If the class is used for processing, use session_set_save_handler (
Array ('classname', 'open '),
Array ('classname', 'close '),
Array ('classname', 'read '),
Array ('classname', 'write '),
Array ('classname', 'deststroy '),
Array ('classname', 'gc '),
)
Call the six static methods in the className class. you do not need to call static methods if you can change the object, but do not need to generate objects if you use static members. This provides better performance.
2.6 Common session functions:
Bool session_start (void); initialize the session
Bool session_destroy (void): deletes the session associated files on the server. Stringsession_id () id of the current session
Stringsession_name () indicates the name of the session currently accessed, that is, the cookie name used by the client to save the session ID. PHPSESSID is used by default. Arraysession_get_cookie_params () details of the session associated with this session.
Stringsession_cache_limiter () controls the client cache ini session_cache_expire () used by the session page to control the client cache time. bool session_destroy () deletes the file void reset (int lifetime [, stringpath [, stringdomain [, bool secure [, bool httponly]) sets the details of the session associated with this session bool session_set_save_handler (callbackopen, callbackclose, callbackread, callbackwrite, callbackstroy, callbackgc) defines the function for processing sessions (not by default)
Bool session_regenerate_id ([bool delete_old_session]) allocates a new session id
2.7 session security issues attackers try to obtain valid session IDs of existing users by investing a lot of energy. with session IDs, they may be able to have the same capabilities as this users in the system.
Therefore, our main solution is to verify the validity of the session ID.
If (! Isset ($ _ SESSION ['User _ agent']) {
$ _ SESSION ['User _ agent'] = $ _ SERVER ['remote _ ADDR ']. $ _ SERVER ['http _ USER_AGENT'];
}
/* If the user session ID is forged */elseif ($ _ SESSION ['User _ agent']! = $ _ SERVER ['remote _ ADDR ']. $ _ SERVER ['http _ USER_AGENT']) {
Session_regenerate_id ();
}
?>
2.8 Differences between Session passing through cookies and passing through SID:
Under the default configuration of the session in php5.2.1, when a session is generated, the server generates a pre-defined Super global variable SID while sending the header set-cookie (that is, writing a cookie is equivalent to throwing a SID .), when $ _ COOKIE ['phpsessid '] exists, no cookie is written or the Super global variable SID is generated. at this time, the SID is empty.
2.9 session instance /**
* Verify the validity of the session *
*/FunctionsessionVerify (){
If (! Isset ($ _ SESSION ['User _ agent']) {
$ _ SESSION ['User _ agent'] = MD5 ($ _ SERVER ['remote _ ADDR ']
. $ _ SERVER ['http _ USER_AGENT ']);
}
/* If the user's session ID is forged, re-allocate the session ID */elseif ($ _ SESSION ['User _ agent']! = MD5 ($ _ SERVER ['remote _ ADDR ']
. $ _ SERVER ['http _ USER_AGENT ']) {
Session_regenerate_id ();
}
}
/**
* Destroy a session
* Perfect implementation in three steps *
*/FunctionsessionDestroy (){
Session_destroy ();
Setcookie (session_name (), '', time ()-3600 );
$ _ SESSION = array ();
}
?>
Note:
The cause of the session header message being sent is the same as that of the cookie.
In php5, the registry configuration options of all php sessions are configurable during programming. In general, we do not need to modify the configuration. for more information about php session registry configuration options, see Session session processing functions in the manual.
During session data storage, the $ _ SESSION array is serialized for storage. Therefore, due to serialization problems, the values of special characters may be encoded using the base64_encode function, base64_decode is used for decoding when reading data.
