note 100595 added to features.cookies

I'm trying to do something similar. I started off by replacing the php sessions with my own "beginnings" of a session handler. My goal was to maintain a constant session ID in a database table and concatenate it to a random value then encrypt it and send it down to the user in a cookie as "authstring". When the user returned, the system would decrypt auth string, extract the constant session ID, lookup in the DB, check that a saved copy of the random value matched that from the authstring and allow them to load the page. So I had this logic in two functions my MembershipHandler class - ReadSession and WriteSession. I called ReadSession on construction of the class and called WriteSession near the end of the main script logic (before rendering to browser). ReadSession checked for "authstring" cookie, if valid extracted session id, got session, checked random string, saved stored session data and id to $_SESSION. It returned false (saving nothing to $_SESSION) if authstring was invalid or not present. WriteSession checked to see whether session id was present in $_SESSION and if not it created a new session id (placing it in $_SESSION). It then generated an authstring using the session id and a random string then saved that random string to $_SESSION. It then did a REPLACE TO on the mysql database with the session ID (so a new one would be created if it did not already exist), including a serialized $_SESSION array (inclusive of random string). Finally it set the authstring cookie. Now my problem is that although I only called the WriteSession function once I had a number of entries written to the DB for the session id. This included new ones every time. When looking into it I found that each time it saved new ones to DB it saved one of those new ones to the cookie. This occasionally matched but not often. I tried to simplify it by setting a constant session ID in a cookie and saving the random string as a separate cookie. This resulted in a single session being created each time in the db but a different random string being saved with that session as to what was saved in the cookie. It feels like the WriteSession function is running > once, but I didn't set it up to do so... Which is weird. This seems to happen any time I try to generate something random, save it in a cookie AND save same thing in DB, then match against each other later. Is there some strange "functions can run more than once by themselves" thing in PHP I don't know about or does this sound like an unfound coding problem? ---- Server IP: 69.147.83.197 Probable Submitter: 61.8.3.160 ---- Manual Page -- http://www.php.net/manual/en/features.cookies.php Edit -- https://master.php.net/note/edit/100595 Del: integrated -- https://master.php.net/note/delete/100595/integrated Del: useless -- https://master.php.net/note/delete/100595/useless Del: bad code -- https://master.php.net/note/delete/100595/bad+code Del: spam -- https://master.php.net/note/delete/100595/spam Del: non-english -- https://master.php.net/note/delete/100595/non-english Del: in docs -- https://master.php.net/note/delete/100595/in+docs Del: other reasons-- https://master.php.net/note/delete/100595 Reject -- https://master.php.net/note/reject/100595 Search -- https://master.php.net/manage/user-notes.php