PHP session_start()

Question

What is this really?

Does it start a current session based on cookies? Got that from the PHP website. How does PHP control the session? If I start a session when a

Answer 1

I assume you want to know what a PHP session means for you, the programmer.

When you do session_start() you are telling PHP that you want to use the session. This is made available to you as an array called $_SESSION. You can use that like any other array with the difference that the stuff you put in there stays there from one page to another (provided you use session_start() at the beginning of each page).

The actual mechanism may vary depending on configuration (php.ini), but a typical installation can use cookies for the session. Let's assume that your webserver is on linux and you're using cookies. You do the following

session_start();
$_SESSION['name']='Bob';

When PHP sees this it creates a text file with a semi-random name (for example sess_a3tfkd5558kf5rlm44i538fj07), sticks the $_SESSION contents in there as plain text and then sends a cookie to the user with the session id, which can be used to find the session file (for example a3tfkd5558kf5rlm44i538fj07).

The next time the user comes back he hands in the session id in his cookie, PHP goes to the relevant file and loads its contents in $_SESSION.

You'll note that the actual information is kept on the server while the user is only given an id. Kinda like handing in your coat in a club and getting a ticket with a number on it.

Answer 2

Like it says in the Manual

session_start() creates a session or resumes the current one based on a session identifier passed via a GET or POST request, or passed via a cookie.

If you start a new session at your login page, the session is initially empty. You can store in it whatever you want, for instance, store the user id once the user has logged in. The session data is destroyed when you close the session.

You might want to read all chapters in the Session Extension Manual Pages and also see

• what is session and cookies in php and where it stored

Answer 3

You can compare PHP session with the cookie, but session is the much more secure way of storing information. Cookie store data on user's computer, but session store on the server in a temporary file securely. I have discussed session and how to use it on one of my blog post - How to start a PHP session, store and accessing Session data?

Below is an example code of storing data in PHP session:

<?php
session_start();
$_SESSION["name"] = "John";
?>

Below is the example of retriving the session data:

<?php
session_start();
echo $_SESSION["name"];
?>

The above code will display the name "John".

Source: How to start a PHP session, store and accessing Session data?

Answer 4

The PHP session system lets you store securely data in the $_SESSION global array. A typical example is to store the user's identifier in the session when they type in their password:

if ($user = try_login($login, $password)) 
  $_SESSION['user'] = $user;

Then, you can access that information on all other pages:

if (isset($_SESSION['user']))
  // logged in !
  echo user_name($_SESSION['user']);

The data is stored on the server, so there is no risk of tampering (on the other hand, mind your disk usage).

Starting the session lets the current request use $_SESSION. If this is the user's first visit, the array will be empty and a new session cookie will be sent for you.

Closing the session merely prevents the current request from using $_SESSION, but the data stays around for the next requests.

Destroying the session throws away all the data, forever. The sessions are destroyed a certain duration after the last visit (usually around 30 minutes).

Answer 5

PHP's session_start starts OR resumes an HTTP session, which is explained fairly well in this article:

http://en.wikipedia.org/wiki/Session_(computer_science)

The concept of an HTTP "session" isn't specific to PHP, it's used in many (all?) server side HTTP frameworks as one way to allow for some state to be stored/associated across different request/responses (since HTTP is stateless). A unique token (which is often, but not always, stored in a cookie) identifies a particular client, and the server can associate the "session."

Here's some more info about sessions and PHP in particular that may help: http://www.php.net/manual/en/book.session.php