Free2Code
Tutorials » Browse » PHP
Tutorials - PHP Sessions - single_page
This article written by
  OldSite

Member since
  October 10, 2006

We’ve had a few requests for tutorials on what “sessions” are and how they work. So in this tutorial I’ll show what they are, how they work and how you can make good use of them.

This tutorial underlines sessions in general, but I use PHP for the code, this is why this tutorial is in the PHP category.

What are sessions?

To understand what sessions are and what they’re good for, it helps if you’ve had some experence with a CGI scripting language and have used cookies from time to time. So why do we use cookies? Consider below.

<?php

$name = 'Jester';

?>

What do we do if we wish to carry that variable to another script? Then another script after that? We have to propagate it, right?

<a href="/another_script.php?name=<?php echo $name; ?>">another script</a>

Then re-assign it to $name:

$name = $_GET['name'];

Doing this over and over is tiresome and annoying. So we set a cookie:

setcookie('name', 'Jester');

Then we can re-assign the cookie to the variable $name without having to pass it along through the scripts manually. It’s available to us in all our scripts, it makes things alot easier. We now have this variable containing the value we choose ready for us to use. Yet, there’s still a snag: what if a user chooses not to accept cookies? This is where sessions come in.

The “Session ID”

When a session is started each user is assigned a unique “session id”. Now how this session ID is stored depends on whether or not the user accepts cookies or not.

  • If the user accepts cookies, the session ID is stored in a cookie, whose name is pre-determined.
  • If the user doesn’t accept cookies, the session ID is propagated through each script via the query string or form inputs.

But, we still have the problem of the no-cookie thing you ask? Well yes, but… imagine we want to set 20 variables, progagating all of those from script to script would be really annoying, with sessions we merely pass the one “session id” value. As long as the user has their session id we can set variables that will then be associated with their session id and available to us.

How it works

When the user’s session starts, they’re assigned a “session id”, this we know so far. When their session is started a file is created on the server-side, this file contains all the user’s session variables and is associated with them by their session id. Session variables are not stored in cookies, they are not propagated through the query string and form inputs, they are stored in a file on the server-side. The whole reason we assign them a session id is so we know which file belongs to who.

John starts a session

He is assigned the session id: 12345678

File created in session folder: sess_12345678

This file now “belongs” to John. If we assign session variables to him, as long as he has his session id, we can associate him with that file, extract the variabels from it and there we have it: variables that can be preserved across multiple requests.

Sounds too complex, though

That’s the good thing about using sessions with PHP, all this is done is for you. All the sessions stuff is handled by PHP and the web server in the background making them extremely easy to implement. Even if users have cookies off you can set PHP up to automatically propagate the session id through your scripts for you. It automatically sticks the session ID in your links and in hidden form inputs, preserving the user’s session id this allowing their file—containing their variables—to be associated with them.

Practical Use

If my inane yapping has gotten the basics across to you we can now look at a practical example.

<?php

session_start(); // start session

$_SESSION['name'] = 'Jester';

?>

It’s as simple as that. We must first start the session using the function session_start(), once we do that the user is assigned their session id which will then be available to scripts via a cookie or through the query string and form inputs. We’re then free to assign them values, so if a user then goes to another script we just retrieve it.

<?php

session_start();

echo 'Hello '.$_SESSION['name'];

?>

To create a session variable just stick it in the $_SESSION array, to retrieve it just drag it from the $_SESSION array. session_start() starts a session for the user.

Remember: You must always use “session_start()” in your script if you want to use the $_SESSION array. session_start() does not only start a user’s session, but it continues a current session. session_start() is used to get the user’s session ID and associate it with their file, thus loading the variables frm the file into $_SESSION, if you do not use session_start() the $_SESSION values will not be available. This also aplies to destroying the session, you must start/resume it before you can destroy it.

<?php

session_start();

unset($_SESSION['name']);

session_destroy();

?>

We can use the unset() function to get rid of session variables, and the session_destroy() function to get rid of the session id altogether, effectively killing the user’s session and any variables associated with their session id.

Why when you login to a site, do you stay logged in? You have a session, until this session is destroyed the username and password you submitted are session variables which are then used in each script to authenticate your login. When you hit “logout”, your session is killed and you must login again.

With the login system on axion-network I decided not to allow users who don’t accept cookies to login. I did this for various reasons. Most of axion-network is HTML compliant and the automatic progagation of the session ID for users with cookies disabled can cause HTML errors. Also the session id existing in the query string poses security risks and can lead to sessions being “stolen”. Be advised this is not a limitation of sessions, sessions work with cookies off, it’s just me being paranoid.

Remember

  • Session variables are not cookies, the session id is (normally).
  • We can use sessions to associate a user with a file on the server side which contains their variables.
  • We can destroy the users’ sessions and kill all associated variables.

References

This was just a very brief explanation (well, an attempt at one) of sessions. See the links below to look deeper into them.


In this tutorial: