How PHP Implements Sessions
How PHP Implements Sessions
PHP allows you to implement a highly effective session management infrastructure in your applications, but you have to do a lot of the hard work yourself.
As you'll see in this section, PHP's built-in session handling isn't really appropriate for enterprise-class applications. Luckily, it has been made extensible enough to give you a head start when you're writing your own more robust solution.
Basic PHP Sessions
Take a look at the following code. Enter it and save it as firstpage.php.
<?php session_start(); $_SESSION['favorite_artist'] - 'Tori Amos'; ?>Currently, my favorite artist is Tori Amos. It may also interest you to know that my identifer for this browser session, as allocated by PHP, is <?=session_id()?>. <BR><BR> <A HREF="secondpage.php">Go to the second page</A> ?>
Now start a brand-new bit of code. Call this secondpage.php.
<?php session_start(); ?>Having checked, I can tell you that my favorite artist is still <?=$_SESSION['favorite_artist']?>. At the moment, my identifier for this browser session, as allocated by PHP, is <?=session_id()?>. <BR><BR> <A HREF="firstpage.php">Go back to the first page</A> ?>
Run the first of these and you should get some predictable output. It turns out that my favorite artist is Tori Amos, and PHP has given me a session identifier (see Figure 15-2).
Figure 15-2
You can see that the session identifier is 32 characters in length. PHP actually uses the full alphabet as well as 0-9. This increases the number of possible session identifiers to 3632. If you click the link, you should see something that looks like Figure 15-3.
Figure 15-3
There are two important things to note. The session identifier is the same, and the second script seems to have remembered my musical preferences.
This result is obtained in a straightforward manner. First, use session_start() to tell PHP to enable sessions, well before the first character of HTML of the script. Using session_start() is important because the session data sent to the Web browser needs to go in the HTTP headers, and the first use of any HTML (or even whitespace) precludes this from happening.
Second, register a session variable by adding to the $_SESSION global associative array (or hash). This can come anywhere in the script because it won't send anything to the Web browser; it just makes a note on the server side, as you will see shortly.
On the second page, call session_start() just as you did on the first to enable session management, but now you can read from $_SESSION just as you wrote to it on the first page. Lo and behold, the value Tori Amos has been successfully retained from one page to the next. This value has been inextricably associated with the session identifier, which explains why the server remembered it.
But how did PHP remember the session identifier from the first page to the second?
Take a look on your server in /tmp. Perform a directory listing using ls for all files starting with sess_ (the word sess followed by an underscore). Notice a file called sess_ followed by the session ID you were allocated in the previous example. Open it using the editor of your choice. You should see something that looks like Figure 15-4.
Figure 15-4
