Re: 'logged in' tracking...

> A user logs in. When they click on a link to go to another page on the > site, we would like to keep their 'logged in' status alive. However, we > would like to do this without cookies, and, if possible, without the ?= in > the URL. Forms are possible, but buttons would look rather odd on some drop > menus we've put in there. You have to use cookies, GET parameters, or POST parameters to keep track of a user. > I looked at the session stuff for PHP4 > (http://www.php.net/manual/ref.session.php), and, if I understand correctly, > if PHP is compiled with --enable-trans-sid , then the ?= in the URL is not > necessary. Is this correct? Would this solve our problem? No. PHP4 sessions use a cookie to store a session ID on the client by default. If it can't use a cookie, because --enable-trans-id is enabled, it will append the session id variable to any relative URLs on your page. Mostly, cookies will be used, but if they're unavailable, you'll get ?SESSION_ID=millisecond_time_number tagged on to the end of all relative URLs. PHP stores all the session variables themselves in either shared memory or a temporary file. The cookie or GET variable is used to track which session the client is using. > I have some session tracking scripts for PHP3, but they involved querying > the db every time a page loads, which although there would be minimal > effects for the user, is undesirable in this situation. > > We have also considered using javascript, in which after a user logs in, we > created a 'hidden' frame with only their user-id and access status. In each > page with content, we would use js to grab those two variables from the > hidden frame and work from there. > > We would prefer using what is available (the PHP4 sessions functionality). > Is that the way we should go or do you recommend another way? PHP4 sessions are good, but they're not working 100% yet. (i.e., there are a few bugs). I could never get session_destroy to work. So I implemented my own session-handling with a persistent database connection and a session table which stores the user's username, a session ID, and session variables. If PHP4 sessions worked correctly, I would use them. Perhaps in the next maintenance release.... As far as Javascript, if security is ANY concern at all for you, then you should abandon this idea promptly. Don't let the user control any authentication information. Dean.