note 88734 added to function.session-id

Been PHP'ing for years. Always done more advanced session handling manually. Finally set up a simple site and decided to use PHP's built in session stuff..... omg.. Reading documentation and examples leads me to think that you can call session_id() (to get the value) before session_start() - to determine if a session already exists. But it doesn't! The SID constant doesn't exist either. Grrr.. You have to call session_start() before session_id() - otherwise session_id() always returns an empty string. But, as we know, session_start() will always create a session. What if you don't want to blindly create a session? Let's say you have a website and only require sessions for admins - and you don't want the overhead of creating a session for your thousands of visitors? aiya. It seems you have to do something like this: if (isset($_COOKIE[session_name()])) { $cookie_id = $_COOKIE[session_name()]; session_start(); if ($cookie_id == session_id()) { // ok - session start "resumed" .. did not create } else { // nope.. session_start() just created a new session - so terminate it // no session } } else { // no session } the first check simply tells you if the session cookie exists (it may not be a valid session id, and doesn't mean a session is in place (i.e. the session file may not exist)). So you've got to compare the session_id in the cookie with the session_id() after calling session_start(). Then you'll have to do subsequent checks (like checking session variables you would have set up when the admin signed in) to make sure the session is a valid one at your application level. Seriously - is it really this hard? Am I missing something? ---- Server IP: 209.41.74.194 Probable Submitter: 71.132.147.187 ---- Manual Page -- http://www.php.net/manual/en/function.session-id.php Edit -- https://master.php.net/note/edit/88734 Del: integrated -- https://master.php.net/note/delete/88734/integrated Del: useless -- https://master.php.net/note/delete/88734/useless Del: bad code -- https://master.php.net/note/delete/88734/bad+code Del: spam -- https://master.php.net/note/delete/88734/spam Del: non-english -- https://master.php.net/note/delete/88734/non-english Del: in docs -- https://master.php.net/note/delete/88734/in+docs Del: other reasons-- https://master.php.net/note/delete/88734 Reject -- https://master.php.net/note/reject/88734 Search -- https://master.php.net/manage/user-notes.php