Session data-files not removed?
| From: | RW-NL) | Date: | Wed, 07 May 2003 08:04:25 +0000 |
| Subject: | Session data-files not removed? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-146627@lists.php.net to get a copy of this message | ||
Now i'm a little confused. I made a script, which starts with
session_start(); and shows the session_id(); on the page and gives you a
form to input something in a text field which will be stored in the session
($_SESSION['name']=$_POST['name']).
Then, i copied the session id displayed on the page, to the url-field (for
example /index.php?PHPSESSID=63et3e9g9dg2d90gd82dg8) and this works, even
when i close the browser, start a new browser and go directly to that url
with PHPSESSID. The session-data with it's name var still exists.
Browser closed, 12 hours later i call that page with that PHPSESSID again
and the session-data still exists.
(BTW, it's PHP4.1.1 on PWS ON NT4)
(THE QUESTION)
This way, the server keeps storing all the session data-files and never
removes them!?!?!?
Here's the most important code of php.ini..
[Session]
; Handler used to store/retrieve data.
session.save_handler = files
; Whether to use cookies.
session.use_cookies = 1
; Name of the session (used as cookie name).
session.name = PHPSESSID
; Initialize session on request startup.
session.auto_start = 0
; Lifetime in seconds of cookie or, if 0, until browser is
restarted.
session.cookie_lifetime = 0
; Handler used to serialize data. php is the standard serializer of
PHP.
session.serialize_handler = php
; Percentual probability that the 'garbage collection' process is
started
; on every session initialization.
session.gc_probability = 1
; After this number of seconds, stored data will be seen as
'garbage' and
; cleaned up by the garbage collection process.
session.gc_maxlifetime = 1440
; Check HTTP Referer to invalidate externally stored URLs containing
ids.
; HTTP_REFERER has to contain this substring for the session to be
; considered as valid.
session.referer_check =
; How many bytes to read from the file.
session.entropy_length = 0
; Specified here to create the session id.
session.entropy_file =
;session.entropy_length = 16
;session.entropy_file = /dev/urandom
; Set to {nocache,private,public} to determine HTTP caching aspects.
session.cache_limiter = nocache
; Document expires after n minutes.
session.cache_expire = 180
; trans sid support is disabled by default.
; Use of trans sid may risk your users security. It may not be
; feasible to use this option for some sites. Use this option with
caution.
session.use_trans_sid = 0
Is there an advisable way to write code so this doesn't happen, or do i
really need to make some changes to php.ini for that.. or what?
Thanks,
M. Vek