Re: [PHP4BETA] Session Management in PHP4

On Thu, Oct 21, 1999 at 03:55:48AM -0400, Jon E. Mitchiner wrote: > I just submitted a bug report for php4 beta 2 in regards to session > management. It allows you to put anything in the session id (assuming your > php tmp dir is somewhere else), for instance: > > http://php.test.com/index.php?SESSIONID=../../../../tmp/test > Agreed, the files module checks now for illegal characters (and too short ids). > I was looking through the documentation for session management, and other > things, and noticed that session management ID's can only be stored in a > temporary dir. Has anyone thought about putting it in a database, rather > than files (as I'm not sure if its planned, or in the works.) I looked > through the session.c code but couldnt find any other option for this, > unless I overlooked something. You can implement database storage by using PHP code and session_set_save_handler(). Have a look at the appended email (can someone please put this into the documentation?). > Are there any other ways to print out the <?=SID?> variable into the url? > For instance, I have lines like: > <? print "<A > HREF=http://www.test.com?"?><?=SID?>> test site > </A> > Is there a better way of doing it, like <? print "<A > HREF=http://www.test.com?";=SID?> (That doesnt work). > Also it does not work > doing something like $test = "blahblahblah=SIDblah"; (I think I missed > another way of setting them, but wanted to doublecheck.) If you compile with --enable-trans-sid, relative URLs will be changed automatically (no need for <?=SID?>). > One drawback I notice with session ID's is there's not an option (atleast > not that I can see) where I can explictly specify whether to permit cookie > (and get) mode, or get mode only. For instance I prefer using with get > mode, but cant find how to do this exclusively. That is not implemented currently. > In regards to above, when in cookie mode, I notice the URL can get sloppy as > I have put a "?" in case if the user falls back to get mode so their session > id can be posted in the URL. So when I enable cookies, I see a "?" at the > end of all of my statements. Perhaps revise =SID so it also prints ? at the > beginning, or another command to automatically add a ?. That was a design decision. It prefers speed over appearance. > Overall, im pretty impressed with PHP4's ability to manage sessions and look > forward to the final release of php4 as the design seems somewhat nicer than > phplib (Ive not yet encountered any cache issues yet.) I will test the > cache portion of session management further but based on initial > impressions, it works nicely. Im happy to be able to use this instead of > using phplib which can get somewhat confusing at times (e.g. forgetting to > do a page_close, and not having registered variables written to the > database.) > > Thanks! Thank you too. -- Regards, Sascha Schumann Consultant

Attachment: [message/rfc822]