Php help needed

[matt678]

How do you code a script that uses session variables, but you don't want it to pass the session id in the url (I've heard of transid how does that work?), do you only need to call Session_start() once for all pages ie on login, or does it need to be placed on every script that uses session variables?

 

[sm]

session_start() will be used for all pages.
In your php.ini file you'll find a section titled: "session". if you look below that you'll find this:

; Whether to use cookies.
session.use_cookies = 1

; This option enables administrators to make their users invulnerable to
; attacks which involve passing session ids in URLs; defaults to 0.
; session.use_only_cookies = 1


so, if you set this latter variable to 1, you will be forcing the use of only cookies for handling sessions. This will result in the scenario that a session will only be created if the user's browser accepts cookies... else session handling will not work... but that's okay because even yahoo mail uses cookied sessions... so you can assume that most browsers will accept cookies.
for those who block cookies you can show a message like: "cant login? try enabling cookies in your browser"

 

[Ray]

you can avoid php sessions and cookies all together by using mysql sessions. There better, more reliable and more secure. Goto a nice tutorial site and learn how to do this. I perily dont care whether the php sessions shows in a browser.

 

[sm]

you can avoid php sessions and cookies all together by using mysql sessions. There better, more reliable and more secure. Goto a nice tutorial site and learn how to do this. I perily dont care whether the php sessions shows in a browser.

......and what would you mean by a mysql session ? do you mean to say that you can use mysql on it's own without using an application programming language like php, jsp, asp etc ... for maintaining user sessions on web browsers ????? :o

I agree that you can store session data in a mysql database instead of in files, but you do need a scripting language to actually accomplish this. so the question isnt whether you can use mysql for storing session data or whether you use flat files... but whether you can do away with session ids being a part of the URL for maintaining user sessions.... and this can be done via cookies stored on the client computer (on the server side you have the choice of storing the actual session data -- as opposed to merely session IDs --- either in ordinary files or in a DB).

I hope this clears up the confusion.

 

[stscac]

Keep it simple, stay with php sessions rather than mysql sessions

-Steve

 

[aween]

Keep it simple, stay with php sessions rather than mysql sessions

-Steve

exactly. register a couple of vars like user/pass(md5) and the ip for example. if one of those becomes incorrect, destroy the session and redirect them to the index

 

[matt678]

Thanks, i guess i'll enable the cookie setting, one thing i've noticed though is that the first page you access on my site makes all the other links include the session id, but when you click on the logo ie go back to index.php none of the links have session id's tagged on but the session functionality remains, does the browser record the session id while you remain on the site?

Another question i have is whether it is possible to tell whether a session has been started on another page and if so, would it be possible then to only continue a session throughout a site if it was started in say the login? ie a session wouldn't be started on a page unless the person has logged in.

 

[LeetPCUser]

Are you looking for something like on my website? Check it out in the bottom link, it has session variables for user login, and what have you.

 

[sm]

the session functionality remains because perhaps the cookie seeting is already enabled, and the session id is stored in the cookie instead of being passed around in the URL parameters

 

[matt678]

Probably true about the sessions, ComputerGeek247 i couldn't find the tut. on your site, the php section states 'comming soon', i'm still looking for a way to tell whether a session has been started on another page on a site without starting a session to check