note 34987 added to function.session-regenerate-id
| From: | simon at studio24 dot net | Date: | Thu, 14 Aug 2003 07:53:27 +0000 |
| Subject: | note 34987 added to function.session-regenerate-id | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-54131@lists.php.net to get a copy of this message | ||
If you use PHP 4.3.2 when you regenerate the Session ID this seems the most stable method of
resetting the cookie:
setcookie(session_name(),$new_id,0,"/");
If you forget to set the path then the cookie will only be valid for the current folder (unless you
are in the website root).
I.e. if the session gets reset in domain.com/members/account then the Session won't propagate
to domain.com/members since the cookie path will have been set to: /members/account/ unless you
specify it.
I would recommend using Mozilla for testing since you can very easily view Cookie contents for
sessions (Firebird - http://www.mozilla.org/products/firebird/ )
So this function works for me (using database storage for sessions):
function resetSession ()
{
$_SESSION = array();
if (version_compare($php_version, "4.3.2", ">=") == 1) {
session_regenerate_id();
} else {
$new_id = newSessionID();
session_id($new_id);
}
// Do we need to reset the Session cookie?
if (version_compare($php_version, "4.3.3", "<") == 1) {
setcookie(session_name(),$new_id,0,"/");
}
return TRUE;
}
function newSessionID ()
{
$unique = FALSE;
while (!$unique) {
$new_id =
md5($_SERVER["UNIQUE_ID"].":".time().":".$_SERVER["REMOTE_ADDR"]);
$sql = "SELECT * FROM session_table WHERE ses_id='$new_id'";
$result = mysql_query($sql) or die("Get unique session id query: ".$sql);
if (mysql_num_rows($result) == 0) {
$unique = TRUE;
}
mysql_free_result($result);
}
return $new_id;
}
Database session storage:
http://uk2.php.net/manual/en/function.session-set-save-handler.php
For those using file storage, you would need to replace the newSessionID() function with one that
checks stored session file names to ensure you have a unique session ID. You might also want to
unlink the old session file as detailed in Dan's note below.
----
Manual Page -- http://www.php.net/manual/en/function.session-regenerate-id.php
Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+34987
Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+34987&report=yes
Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+34987&report=yes