session_start

    (PHP 4, PHP 5, PHP 7, PHP 8)

    session_start — Начинает или возобновляет сессию

    Описание

    session_start(array $options = []): bool

    Функция session_start() создаёт новую сессию или на основе идентификатора сессии, который передали через GET- или POST-запрос либо в блоке данных cookie, возобновляет сессию, которую запустили прежде.

    При вызове функции session_start() или автозапуске сессии PHP вызовет открытие и чтение обработчиков сохранения сессии. Это будет встроенный обработчик сохранения по умолчанию, обработчик, который установил PHP-модуль наподобие SQLite или Memcached, или пользовательский обработчик, который определили функцией session_set_save_handler(). Callback-функция чтения извлечёт существующие данные сессии, которые PHP хранит в сериализованном виде, и вернёт сохранённые данные обработчику PHP-сессий, который десериализует и занесёт данные в суперглобальный массив $_SESSION.

    Перед вызовом функции session_start() вызывают функцию session_name(), чтобы назвать сессию произвольно.

    При включённой опции session.use_trans_sid функция session_start() зарегистрирует внутренний обработчик вывода для перезаписи URL-адресов.

    Порядок вызова функций играет важную роль для правильного вывода данных при передаче в функцию ob_start() обработчика вывода сжатых данных ob_gzhandler или похожей callback-функции. Например, обработчик ob_gzhandler требуется зарегистрировать до начала сессии.

    Список параметров

    options

    Параметр принимает ассоциативный массив опций, которые переопределят текущий набор директив конфигурации сессии. Префикс session. в названиях опций указывать не требуется.

    Стандартный набор директив конфигурации дополняет опция read_and_close. Со значением true опция сразу закроет сессию, когда обработчик сохранения сессии прочитает данные, что исключит ненужную блокировку, когда данные сессии не изменяются.

    Возвращаемые значения

    Функция возвращает true, если сессия успешно запустилась, иначе false.

    Список изменений

    Версия Описание
    7.1.0 Теперь функция session_start() возвращает false и больше не инициализирует суперглобальный массив $_SESSION, когда не смогла запустить сессию.

    Примеры

    Базовый пример запуска сессии

    Пример #1 page1.php

    <?php

    // page1.php

    session_start();

    echo     'Добро пожаловать на страницу 1';

    $_SESSION['favcolor'] = 'зелёный';
    $_SESSION['animal'] = 'кот';
    $_SESSION['time'] = time();

    // Работает, если получатель принял сессионный блок данных cookie
    echo '<br /><a href="page2.php">page 2</a>';

    // Или вывод передают вместе с идентификатором сессии, если требуется
    echo '<br /><a href="page2.php?' . SID . '">page 2</a>';

    ?>

    После просмотра страницы page1.php вторая страница — page2.php — волшебным образом будет содержать данные сессии. Справочник по работе с функциями сессий даёт дополнительную информацию о передаче идентификатора сессии, включая сведения о том, как работает константа SID.

    Пример #2 page2.php

    <?php

    // page2.php

    session_start();

    echo     'Добро пожаловать на страницу 2<br />';

    echo     $_SESSION['favcolor']; // зелёный
    echo $_SESSION['animal']; // кот
    echo date('Y m d H:i:s', $_SESSION['time']);

    // В этом месте можно использовать константу SID, как это делал код страницы page1.php
    echo '<br /><a href="page1.php">page 1</a>';

    ?>

    Пример передачи опций в функцию session_start()

    Пример #3 Переопределение времени жизни cookie

    <?php

    // Устанавливаем срок действия cookie равным одному дню
    session_start([
    'cookie_lifetime' => 86400,
    ]);

    ?>

    Пример #4 Чтение и закрытие сессии

    <?php

    // Переменные сессии просто считывают и сразу закрывают сессию,
    // если известно, что в сессии не требуется ничего изменять,
    // чтобы не блокировать файл сессии, который потребуется другим скриптам, а с ним и другие страницы
    session_start([
    'cookie_lifetime' => 86400,
    'read_and_close' => true,
    ]);

    ?>

    Примечания

    Замечание:

    Функцию session_start() требуется вызывать перед выводом данных в браузер, чтобы работать с сессиями на основе блоков данных cookies.

    Замечание:

    Вызову функции ob_gzhandler() лучше предпочесть включение опции zlib.output_compression.

    Замечание:

    Функция отправляет ряд HTTP-заголовков, состав которых зависит от настроек. Описание функции session_cache_limiter() рассказывает, как настроить состав заголовков, которые отправит функция.

    Смотрите также

    • $_SESSION
    • Директива конфигурации session.auto_start
    • session_id() - Получает и (или) устанавливает идентификатор текущей сессии

    Нашли ошибку?

    Инструкция • Исправление • Сообщение об ошибке
    ＋Добавить

    Примечания пользователей 36 notes

    up
    30
    linblow at hotmail dot fr
    14 years ago
    If you want to handle sessions with a class, I wrote this little class:

    <?php

    /*
    Use the static method getInstance to get the object.
    */

    class Session
    {
    const     SESSION_STARTED = TRUE;
    const     SESSION_NOT_STARTED = FALSE;

    // The state of the session
    private $sessionState = self::SESSION_NOT_STARTED;

    // THE only instance of the class
    private static $instance;


    private function     __construct() {}


    /**
    * Returns THE instance of 'Session'.
    * The session is automatically initialized if it wasn't.
    *
    * @return object
    **/

    public static function getInstance()
    {
    if ( !isset(    self::$instance))
    {
    self::$instance = new self;
    }

    self::$instance->startSession();

    return     self::$instance;
    }


    /**
    * (Re)starts the session.
    *
    * @return bool TRUE if the session has been initialized, else FALSE.
    **/

    public function startSession()
    {
    if (     $this->sessionState == self::SESSION_NOT_STARTED )
    {
    $this->sessionState = session_start();
    }

    return     $this->sessionState;
    }


    /**
    * Stores datas in the session.
    * Example: $instance->foo = 'bar';
    *
    * @param name Name of the datas.
    * @param value Your datas.
    * @return void
    **/

    public function __set( $name , $value )
    {
    $_SESSION[$name] = $value;
    }


    /**
    * Gets datas from the session.
    * Example: echo $instance->foo;
    *
    * @param name Name of the datas to get.
    * @return mixed Datas stored in session.
    **/

    public function __get( $name )
    {
    if ( isset(    $_SESSION[$name]))
    {
    return     $_SESSION[$name];
    }
    }


    public function     __isset( $name )
    {
    return isset(    $_SESSION[$name]);
    }


    public function     __unset( $name )
    {
    unset(     $_SESSION[$name] );
    }


    /**
    * Destroys the current session.
    *
    * @return bool TRUE is session has been deleted, else FALSE.
    **/

    public function destroy()
    {
    if (     $this->sessionState == self::SESSION_STARTED )
    {
    $this->sessionState = !session_destroy();
    unset(     $_SESSION );

    return !    $this->sessionState;
    }

    return     FALSE;
    }
    }

    /*
    Examples:
    */

    // We get the instance
    $data = Session::getInstance();

    // Let's store datas in the session
    $data->nickname = 'Someone';
    $data->age = 18;

    // Let's display datas
    printf( '<p>My name is %s and I\'m %d years old.</p>' , $data->nickname , $data->age );

    /*
    It will display:

    Array
    (
    [nickname] => Someone
    [age] => 18
    )
    */

    printf( '<pre>%s</pre>' , print_r( $_SESSION , TRUE ));

    // TRUE
    var_dump( isset( $data->nickname ));

    // We destroy the session
    $data->destroy();

    // FALSE
    var_dump( isset( $data->nickname ));

    ?>

    I prefer using this class instead of using directly the array $_SESSION.
    up
    22
    aaronw at catalyst dot net dot nz
    9 years ago
    As others have noted, PHP's session handler is blocking. When one of your scripts calls session_start(), any other script that also calls session_start() with the same session ID will sleep until the first script closes the session.

    A common workaround to this is call session_start() and session_write_close() each time you want to update the session.

    The problem with this, is that each time you call session_start(), PHP prints a duplicate copy of the session cookie to the HTTP response header. Do this enough times (as you might do in a long-running script), and the response header can get so large that it causes web servers & browsers to crash or reject your response as malformed.

    This error has been reported to PHP HQ, but they've marked it "Won't fix" because they say you're not supposed to open and close the session during a single script like this. https://bugs.php.net/bug.php?id=31455

    As a workaround, I've written a function that uses headers_list() and header_remove() to clear out the duplicate cookies. It's interesting to note that even on requests when PHP sends duplicate session cookies, headers_list() still only lists one copy of the session cookie. Nonetheless, calling header_remove() removes all the duplicate copies.

    <?php
    /**
    * Every time you call session_start(), PHP adds another
    * identical session cookie to the response header. Do this
    * enough times, and your response header becomes big enough
    * to choke the web server.
    *
    * This method clears out the duplicate session cookies. You can
    * call it after each time you've called session_start(), or call it
    * just before you send your headers.
    */
    function clear_duplicate_cookies() {
    // If headers have already been sent, there's nothing we can do
    if (headers_sent()) {
    return;
    }

    $cookies = array();
    foreach (    headers_list() as $header) {
    // Identify cookie headers
    if (strpos($header, 'Set-Cookie:') === 0) {
    $cookies[] = $header;
    }
    }
    // Removes all cookie headers, including duplicates
    header_remove('Set-Cookie');

    // Restore one copy of each cookie
    foreach(array_unique($cookies) as $cookie) {
    header($cookie, false);
    }
    }
    ?>
    up
    16
    ohcc at 163 dot com
    11 years ago
    The constant SID would always be '' (an empty string) if directive session.use_trans_sid in php ini file is set to 0.

    So remember to set session.use_trans_sid to 1 and restart your server before you use SID in your php script.
    up
    10
    marco dot agnoli at me dot com
    7 years ago
    I recently made an interesting observation:

    It seems that `session_start()` can return `true` even if the session was not properly created. In my case, the disk storage was full and so the session data could not be written to disk. I had some logic that resulted in an infinite loop when the session was not written to disk.

    To check if the session really was saved to disk I used:

    ```
    <?php

    function safe_session_start() {
    # Attempt to start a session
    if (!@\session_start()) return false;

    #
    # Check if we need to perform
    # the write test.
    #
    if (!isset($_SESSION['__validated'])) {
    $_SESSION['__validated'] = 1;

    # Attempt to write session to disk
    @\session_write_close();

    # Unset the variable from memory.
    # This step may be unnecessary
    unset($_SESSION['__validated']);

    # Re-start session
    @\session_start();

    # Check if variable value is retained
    if (!isset($_SESSION['__validated'])) {
    # Session was not written to disk
    return false;
    }
    }

    return     true;
    }

    if (!    safe_session_start()) {
    # Sessions are probably not written to disk...
    # Handle error accordingly.
    }

    ?>
    ```

    Took me quite a while to figure this out.

    Maybe it helps someone!
    up
    11
    bachtel at [googles email service]dotcom
    8 years ago
    If you are using a custom session handler via session_set_save_handler() then calling session_start() in PHP 7.1 you might see an error like this:
    session_start(): Failed to read session data: user (path: /var/lib/php/session) in ...

    As of this writing, it seems to be happening in PHP 7.1, and things look OK in PHP7.0.

    It is also hard to track down because if a session already exists for this id (maybe created by an earlier version of PHP), it will not trigger this issue because the $session_data will not be null.

    The fix is simple... you just need to check for 'null' during your read function:

    <?php

    function read($id)
    {
    //... pull the data out of the DB, off the disk, memcache, etc
    $session_data = getSessionDataFromSomewhere($id);

    //check to see if $session_data is null before returning (CRITICAL)
    if(is_null($session_data))
    {
    $session_data = ''; //use empty string instead of null!
    }

    return     $session_data;
    }

    ?>
    up
    9
    emre@yazici
    15 years ago
    PHP Manual specifically denotes this common mistake:

    Depending on the session handler, not all characters are allowed within the session id. For example, the file session handler only allows characters in the range a-z A-Z 0-9 , (comma) and - (minus)!

    See session_id() manual page for more details.
    up
    11
    dave1010 at gmail dot com
    14 years ago
    PHP locks the session file until it is closed. If you have 2 scripts using the same session (i.e. from the same user) then the 2nd script will not finish its call to session_start() until the first script finishes execution.

    If you have scripts that run for more than a second and users may be making more than 1 request at a time then it is worth calling session_write_close() as soon as you've finished writing session data.

    <?php
    // a lock is places on the session, so other scripts will have to wait
    session_start();

    // do all your writing to $_SESSION
    $_SESSION['a'] = 1;

    // $_SESSION can still be read, but writing will not update the session.
    // the lock is removed and other scripts can now read the session
    session_write_close();

    do_something_slow();
    ?>

    Found this out from http://konrness.com/php5/how-to-prevent-blocking-php-requests/
    up
    1
    bwz
    2 years ago
    Be warned of another issue with blocking sessions: if you want to call an external program (or use an external service) that needs to access your website using the same session.

    For example I am printing a page as a PDF. I can just save the web page as a HTML file. But the images in the HTML are also private and require the current user session to be seen.

    What will happen is that this program might hang indefinitely (or timeout) as session_start waits for the parent PHP process to release the lock. And session_start doesn't obey max_execution_time (as documented in this bug: https://bugs.php.net/bug.php?id=72345 ), so this will effectively kill the server after a few requests, as each one will be hanging forever

    It's the same if you use an external HTTP service:

    <?php
    $pdf     = file_get_contents('http://pdf.website.tld/?url=http://website.tld/print.php');
    ?>

    The service will wait for the website host to release the lock, but it can't as it is waiting for the PDF service to finish...

    The nice solution is to release the lock immediately by calling session_write_close after session_start, and when you need to write to the session you do the same again, but as noted it has its own issues. Using a custom session handler is probably the best solution.
    up
    8
    elitescripts2000 at yahoo dot com
    11 years ago
    3 easy but vital things about Sessions in AJAX Apps.

    <?php
    // session start

    // It is VERY important to include a Period if using
    // a whole domain. (.yourdomain.com)
    // It is VERY important to set the root path your session will always
    // operate in... (/members) will ensure sessions will NOT be interfered
    // with a session with a path of say (/admin) ... so you can log in
    // as /admin and as /members... NEVER do unset($_SESSION)
    // $_SESSION=array(); is preferred, session_unset(); session_destroy();

    session_set_cookie_params(0, '/members', '.yourdomain.com', 0, 1);
    session_start();
    $_SESSION = array();
    session_unset();
    session_destroy();

    session_set_cookie_params(0, '/members', '.yourdomain.com', 0, 1);
    session_start();

    $_SESSION['whatever'] = 'youwhat';

    // session destroying

    // To be safe, clear out your $_SESSION array
    // Next, what most people do NOT do is delete the session cookie!
    // It is easy to delete a cookie by expiring it long before the current time.
    // The ONLY WAY to delete a cookie, is to make sure ALL parameters match the
    // cookie to be deleted...which is easy to get those params with
    // session_get_cookie_params()...
    // FInally, use session_unset(); and session_destroy(); in this order to ensure
    // Chrome, IE, Firefox and others, are properly destroying the session.
    $_SESSION = array();
    if (    ini_get('session.use_cookies'))
    {
    $p = session_get_cookie_params();
    setcookie(session_name(), '', time() - 31536000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
    }
    session_unset();
    session_destroy();

    // AJAX and SESSIONS.
    // Example... you start a session based PHP page, which then calls an Ajax (XMLHTTP) authenticated
    // using the SAME SESSION to Poll and output the data, for example. But, you notice when you
    // try to start the Polling AJAX call always HANGS and seems to hang at the session_start().
    // This is because the session is opened in the first page, calls the AJAX polling example, and
    // tries to open the same session (for authentication) and do the AJAX call, you MUST call
    // session_write_close(); meaning you are done writing to the $_SESSION variable, which really
    // represents a file that must be CLOSED with session_write_close();....
    // THAN you can call your AJAX Polling code to reopen the same session and do its polling...
    // Normally, the $_SESSION is closed automatically when the script is closed or finished executing
    // So, if you need to keep a PHP page running after opening a SESSION, simply close it when finished
    // writing to $_SESSION so the AJAX polling page can authenticate and use the same session in a
    // seperate web page...

    session_write_close();

    ?>

    Hope this helps someone with their sessions...
    Thanks.
    up
    4
    Anonymous
    4 years ago
    Be careful with the 'read_and_close' option. It doesn't update the session file's last modification time unlike the default PHP behaviour when you don't close the session (or when you use session_write_close explicitly).
    Old session files (for me, older than 24 minutes) will be occasionally cleared by the garbage collector (for me every 09 and 39 minute of every hour).
    So a session can disappear even if the page regularly sends requests to the server that only reads and closes the session.
    up
    10
    someOne_01 at somewhere dot com
    12 years ago
    When you have an import script that takes long to execute, the browser seem to lock up and you cannot access the website anymore. this is because a request is reading and locking the session file to prevent corruption.

    you can either
    - use a different session handler with session_set_save_handler()
    - use session_write_close() in the import script as soon you don't need session anymore (best moment is just before the long during part takes place), you can session_start when ever you want and as many times you like if your import script requires session variables changed.

    example
    <?php
    session_start    (); //initiate / open session
    $_SESSION['count'] = 0; // store something in the session
    session_write_close(); //now close it,
    # from here every other script can be run (and makes it seem like multitasking)
    for($i=0; $i<=100; $i++){ //do 100 cycles
    session_start(); //open the session again for editing a variable
    $_SESSION['count'] += 1; //change variable
    session_write_close(); //now close the session again!
    sleep(2); //every cycle sleep two seconds, or do a heavy task
    }
    ?>
    up
    4
    hu60 dot cn at gmail dot com
    5 years ago
    The following code shows how the PHP session works. The function my_session_start() does almost the same thing as session_start().

    <?php
    error_reporting    (E_ALL);
    ini_set('display_errors', true);
    ini_set('session.save_path', __DIR__);

    my_session_start();

    echo     '<p>session id: '.my_session_id().'</p>';

    echo     '<code><pre>';
    var_dump($_SESSION);
    echo     '</pre></code>';

    $now = date('H:i:s');
    if (isset(    $_SESSION['last_visit_time'])) {
    echo     '<p>Last Visit Time: '.$_SESSION['last_visit_time'].'</p>';
    }
    echo     '<p>Current Time: '.$now.'</p>';

    $_SESSION['last_visit_time'] = $now;

    function     my_session_start() {
    global     $phpsessid, $sessfile;

    if (!isset(    $_COOKIE['PHPSESSID']) || empty($_COOKIE['PHPSESSID'])) {
    $phpsessid = my_base32_encode(my_random_bytes(16));
    setcookie('PHPSESSID', $phpsessid, ini_get('session.cookie_lifetime'), ini_get('session.cookie_path'), ini_get('session.cookie_domain'), ini_get('session.cookie_secure'), ini_get('session.cookie_httponly'));
    } else {
    $phpsessid = substr(preg_replace('/[^a-z0-9]/', '', $_COOKIE['PHPSESSID']), 0, 26);
    }

    $sessfile = ini_get('session.save_path').'/sess_'.$phpsessid;
    if (    is_file($sessfile)) {
    $_SESSION = unserialize(file_get_contents($sessfile));
    } else {
    $_SESSION = array();
    }
    register_shutdown_function('my_session_save');
    }

    function     my_session_save() {
    global     $sessfile;

    file_put_contents($sessfile, serialize($_SESSION));
    }

    function     my_session_id() {
    global     $phpsessid;
    return     $phpsessid;
    }

    function     my_random_bytes($length) {
    if (    function_exists('random_bytes')) {
    return     random_bytes($length);
    }
    $randomString = '';
    for (    $i = 0; $i < $length; $i++) {
    $randomString .= chr(rand(0, 255));
    }
    return     $randomString;
    }

    function     my_base32_encode($input) {
    $BASE32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
    $output = '';
    $v = 0;
    $vbits = 0;
    for (    $i = 0, $j = strlen($input); $i < $j; $i++) {
    $v <<= 8;
    $v += ord($input[$i]);
    $vbits += 8;
    while (    $vbits >= 5) {
    $vbits -= 5;
    $output .= $BASE32_ALPHABET[$v >> $vbits];
    $v &= ((1 << $vbits) - 1);
    }
    }
    if (    $vbits > 0) {
    $v <<= (5 - $vbits);
    $output .= $BASE32_ALPHABET[$v];
    }
    return     $output;
    }
    up
    3
    ben dot morin at spaboom dot com
    18 years ago
    James at skinsupport dot com raises a good point (warning) about additional requests from the browser. The request for favicon.ico, depending on how it is handled, can have unintended results on your sessions.

    For example, suppose you have ErrorDocument 404 /signin.php, no favicon.ico file and all pages in your site where the user signs in are also redirected to /signin.php if they're not already signed in.

    If signin.php does any clean up or reassigning of session_id (as all good signin.php pages should) then the additional request from the browser for favicon.ico could potentially corrupt the session as set by the actual request.

    Kudos to James for pointing it out and shame on me for skimming past it and not seeing how it applied to my problem. Thanks too to the Firefox Live HTTP Headers extension for showing the additional request.

    Don't waste days or even hours on this if your session cookies are not being sent or if the session data isn't what you expect it to be. At a minimum, eliminate this case and see if any additional requests could be at fault.
    up
    4
    James
    18 years ago
    To avoid the notice commited by PHP since 4.3.3 when you start a session twice, check session_id() first:

    if (session_id() == "")
    session_start();
    up
    5
    jamestrowbridge at gmail dot com
    15 years ago
    Unfortunately, after pulling my hair out trying to figure out why my application was working fine in every browser other than IE ( Internet Explorer) (Opera, Chrome, Firefox, Safari are what I've tested this in) - when using a DNS CNAME record (like a vanity name that is different from the DNS A record, which is the hostname of the server) sessions do not work correctly.

    If you store a session var while on the CNAME:
    vanity.example.com and the hostname of the server is hosname.example.com
    Then try to call the variable from a different page, it will not find it because of the CNAME (I guess it store the variable under the hostname, then when trying to read it it's still looking under the CNAME) the same application works fine when accessing it under the hostname directly. Keep in mind that I was testing this on an internal network.
    up
    4
    jorrizza at gmail dot com
    20 years ago
    If you open a popup window (please no commercial ones!) with javascript window.open it might happen IE blocks the session cookie.
    A simple fix for that is opening the new window with the session ID in a GET value. Note I don't use SID for this, because it will not allways be available.

    ----page.php----
    //you must have a session active here
    window.open('popup.php?sid=<?php echo session_id(); ?>', '700x500', 'toolbar=no, status=no, scrollbars=yes, location=no, menubar=no, directories=no, width=700, height=500');

    ----popup.php----
    <?php
    session_id    (strip_tags($_GET['sid']));
    session_start();
    //and go on with your session vars
    ?>
    up
    3
    axew3 at axew3 dot com
    7 years ago
    X Maintainers ... Sorry to be such pain the ass, please delete this duplicate, because submitted in a crazy 'session' where i've mess things between browser tabs ... sorry again, alessio
    http://php.net/manual/en/function.session-start.php#121310
    up
    3
    schlang
    15 years ago
    if you store your sessions in a database, always ensure that the type of the database column is large enough for your session values
    up
    3
    andy_isherwood at hotmail dot com
    16 years ago
    A session created with session_start will only be available to pages within the directory tree of the page that first created it.

    i.e. If the page that first creates the session is /dir1/dir2/index.php and the user then goes to any page above dir2 (e.g. /dir1/index.php), session_start will create a new session rather than use the existing one.
    up
    2
    ilnomedellaccount at gmail dot com
    11 years ago
    A note about session_start(), custom handlers and database foreign key constraints, which I think may be of some use...

    We know that if we want our sessions into a database table (rather than the default storage), we can refer to session_set_save_handler(...) to get them there. Note that session_set_save_handler must (obviously) be called before session_start(), but let me get to the point...

    Upon calling session_start() the "first time", when the session does not already exist, php will spawn a new session but will not call the write handler until script execution finishes.

    Thus, the session at this point exists in the server process memory, but won't be visible as a row in the DB before the script ends.

    This seems reasonable, because this avoids some unnecessary database access and resource usage before we even populate our session with meaningfull and definitive data, but this also has side-effects.

    In my case, the script called session_start() to make sure a session was initiated, then used session_id() to populate another table in the DB, which had foreign_key constraint to the "sessions" table. This failed because no session was in the db at that point, yet!

    I know I could simply force the creation of the row in the DB by manually calling the write handler after session_start(), when necessary, but I am not sure if this is the best possible approach.

    As soon as I find an "elegant" solution, or a completely different approach, I will post some working sample code.

    In the meanwhile... have fun!
    up
    1
    chris at ocproducts dot com
    8 years ago
    Initiating a session may overwrite your own custom cache control header, which may break clicking back to get back to a prior post request (on Chrome at least).
    On my system it was setting 'no-store', which is much more severe than 'no-cache' and what was breaking the back-button.

    If you are controlling your own cache headers carefully you need to call:
    session_cache_limiter('');

    ...to stop it changing your cache control headers.
    up
    1
    polygon dot co dot in at gmail dot com
    4 months ago
    <?php
    session_start    ([
    'read_and_close' => true,
    ]);
    ?>

    The read_and_close option I believed was to work as a read only mode session

    To the surprise it works even if no sessionId cookie is present in the http request and generates a new sessionId.

    Secondly, the function with this option also generates new session files with respect to the newly generated sessionId

    Third, if the sessionId is invalid (no file is present with respect to sessionId) it creates a new one.
    up
    1
    fabmlk at hotmail dot com
    9 years ago
    If you ever need to open multiple distinct sessions in the same script and still let PHP generate session ids for you, here is a simple function I came up with (PHP default session handler is assumed):

    <?php
    /**
    * Switch to or transparently create session with name $name.
    * It can easily be expanded to manage different sessions lifetime.
    */
    function session_switch($name = "PHPSESSID") {
    static     $created_sessions = array();

    if (    session_id() != '') { // if a session is currently opened, close it
    session_write_close();
    }
    session_name($name);
    if (isset(    $_COOKIE[$name])) { // if a specific session already exists, merge with $created_sessions
    $created_sessions[$name] = $_COOKIE[$name];
    }
    if (isset(    $created_sessions[$name])) { // if existing session, impersonate it
    session_id($created_sessions[$name]);
    session_start();
    } else {     // create new session
    session_start();
    $_SESSION = array(); // empty content before duplicating session file
    // duplicate last session file with new id and current $_SESSION content
    // If this is the first created session, there is nothing to duplicate from and passing true as argument will take care of "creating" only one session file
    session_regenerate_id(empty($created_sessions));
    $created_sessions[$name] = session_id();
    }
    }

    session_switch("SESSION1");
    $_SESSION["key"] = "value1"; // specific to session 1
    session_switch("SESSION2");
    $_SESSION["key"] = "value2"; // specific to session 2
    session_switch("SESSION1");
    // back to session 1
    // ...
    ?>

    When using this function, session_start() should not be called on its own anymore (can be replaced with a call to session_switch() without argument).
    Also remember that session_start() sets a Set-Cookie HTTP header on each call, so if you echo in-between sessions, wrap with ouput buffering.

    Note: it's probably rarely a good idea to handle multiple sessions so think again if you think you have a good use for it.
    Personally it played its role for some quick patching of legacy code I had to maintain.
    up
    1
    info at nospam dot mmfilm dot sk
    15 years ago
    For those of you running in problems with UTF-8 encoded files:

    I was getting an error because of the BOM, although i set Dreamweaver to "save as" the without the BOM. It appears that DW will not change this setting in already existing files. After creating a new file withou the BOM, everything worked well.

    I also recommend http://people.w3.org/rishida/utils/bomtester/index.php - a utility that remote checks for the presence of BOM.
    up
    0
    theking2(at)king.ma
    9 months ago
    I generally use this to start a new session

    <?php
    session_start    ( [
    'name' => DEBUG ? 'SessionId' : '__Secure-SessionId',
    'cookie_lifetime' => 0,
    'cookie_path' => '/',
    'cookie_secure' => true,
    'cookie_httponly' => true,
    'cookie_samesite' => 'Strict',
    'sid_length' => 96,
    'sid_bits_per_character' => 5,
    'use_strict_mode' => true,
    'referer_check' => $_SERVER['HTTP_HOST'],
    ] );
    ?>

    which will create a session with increased entropy in the session cookie name, requires a secure session, make sure roque refers have no chance at my logon page among other things.

    According to MDN[1] prefix "__Secure-" must be set for secure sessions.

    [1](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie)
    up
    0
    axew3 at axew3 dot com
    7 years ago
    I need, with easy, count how many times the page reload over the site, may to add a warning popup, while the counter is 0 ...
    session_start();
    if(isset($_SESSION['count'])){
    $count = $_SESSION['count'];
    $count++;
    $count = $_SESSION['count'] = $count;
    } else {
    $count = $_SESSION['count'] = 0;
    }
    echo $count;

    //session_destroy();
    up
    0
    Charlie at NOSPAM dot example dot com
    15 years ago
    Be warned that depending on end of script to close the session will effectively serialize concurrent session requests. Concurrent background "data retrieval" (e.g. applications such as AJAX or amfphp/Flex) expecting to retrieve data in parallel can fall into this trap easily.

    Holding the session_write_close until after an expensive operation is likewise problematic.

    To minimize effects, call session_write_close (aka session_commit) as early as practical (e.g. without introducing race conditions) or otherwise avoid the serialization bottleneck.
    up
    -1
    axew3 at axew3 dot com
    7 years ago
    I just need with easy, count how many times the page reload over the site, may to add a warning popup, while the counter is 0:

    session_start();
    if(isset($_SESSION['count'])){
    $count = $_SESSION['count'];
    $count++;
    $count = $_SESSION['count'] = $count;
    } else {
    $count = $_SESSION['count'] = 0;
    }
    echo $count;

    //session_destroy();
    up
    -1
    polygon dot co dot in at gmail dot com
    3 years ago
    Websites are prone to Session Attack where its proper usage is not done.

    There are tools like "Apache Benchmark" (ab) and many others which can hit the website with load for load / performance testing.

    Code below starts the session for every request.

    <?php
    session_start    ();

    $username = $_POST['username'];
    $password = $_POST['password'];

    if(    isValidUser($username, $password)) {

    Suserdetails = getUserDetails($username);

    $_SESSION['user_id'] = Suserdetails['user_id'];
    $_SESSION['username'] = Suserdetails['username'];
    $_SESSION['firstname'] = Suserdetails['firstname'];

    header('Location: dashboard.php');
    }
    ?>

    This generates session file for every request irrespective of PHPSESSID cookie value when I use tools like ab, there by creating inode issue.

    One should start the session after properly authenticating.

    <?php

    $username     = $_POST['username'];
    $password = $_POST['password'];

    if(    isValidUser($username, $password)) {

    Suserdetails = getUserDetails($username);

    session_start();

    $_SESSION['user_id'] = Suserdetails['user_id'];
    $_SESSION['username'] = Suserdetails['username'];
    $_SESSION['firstname'] = Suserdetails['firstname'];

    header('Location: dashboard.php');
    }
    ?>

    Scripts other then login first validates session which requires session.

    <?php

    if(session_status()!=PHP_SESSION_NONE) header('Location: login.php');

    session_start();

    if(!isset(    $_SESSION['user_id'])) header('Location: login.php');

    code logic below....
    }
    ?>

    This example is for file based session.
    For other modes of session check function session_set_save_handler.
    up
    -2
    anon at ymous dot com
    14 years ago
    I am trying to get a session created by a browser call to be used by a command line cli->curl php call (in this case, both calls to the same server and php.ini), for a set of flexible media import routines,

    but the cli->curl call always starts a new session despite me putting PHPSESSID=validID as the first parameter for the url called by curl.

    I was able to fix it by calling session_id($_GET['PHPSESSID']) before calling session_start() in the script called via curl.
    up
    -3
    sanjuro at 1up-games dot com
    13 years ago
    The problem with SID is that if on occasions you don't start a session, instead of outputting an empty string for transparent integration it will return the regular undefined constant notice. So you might want to test the constant with defined() beforehand.
    up
    -4
    info.at.merchandisinginteractive.sk
    15 years ago
    A handy script that checks fot the presence of uft-8 byte order mark (BOM) in all files in all directories starting on current dir. Combined from the work of other people here...

    <?php
    function fopen_utf8 ($filename) {
    $file = @fopen($filename, "r");
    $bom = fread($file, 3);
    if (    $bom != b"\xEF\xBB\xBF")
    {
    return     false;
    }
    else
    {
    return     true;
    }
    }

    function     file_array($path, $exclude = ".|..|design", $recursive = true) {
    $path = rtrim($path, "/") . "/";
    $folder_handle = opendir($path);
    $exclude_array = explode("|", $exclude);
    $result = array();
    while(    false !== ($filename = readdir($folder_handle))) {
    if(!    in_array(strtolower($filename), $exclude_array)) {
    if(    is_dir($path . $filename . "/")) {
    // Need to include full "path" or it's an infinite loop
    if($recursive) $result[] = file_array($path . $filename . "/", $exclude, true);
    } else {
    if (     fopen_utf8($path . $filename) )
    {
    //$result[] = $filename;
    echo ($path . $filename . "<br>");
    }
    }
    }
    }
    return     $result;
    }

    $files = file_array(".");
    ?>
    up
    -3
    dstuff at brainsware dot org
    15 years ago
    It seems like spaces in the name don't work either - got a new session id generated each time
    up
    -4
    m dot kuiphuis at hccnet dot nl
    21 years ago
    [Editors Note: For more information about this
    http://www.zvon.org/tmRFC/RFC882/Output/chapter5.html ]

    I use name-based virtual hosting on Linux with Apache and PHP 4.3.2.
    Every time when I refreshed (by pressing F5 in Internet Explorer) I noticed that I got a new session_id. Simultaneously browsing the same site with Netscape didn't give me that problem. First I thought this was some PHP issue (before I tested it with Netscape), but after searching a lot on the internet I found the problem.
    Since I was using name based virtual hosting for my testserver and we have different webshops for different customers I used the syntax webshop_customername.servername.nl as the domain-name.
    The _ in the domain name seemed to be the problem. Internet Explorer just denies setting the cookie on the client when there is a special character (like an _ ) in the domain name. For more information regarding this issue: http://support.microsoft.com/default.aspx?scid=kb;EN-US;316112
    Stupidly enough, this information was related to asp (yuk :o)
    up
    -4
    leandroico---at---gmail---dot---com
    18 years ago
    TAGS: session_start headers output errors include_once require_once php tag new line

    Errors with output headers related to *session_start()* being called inside include files.

    If you are starting your session inside an include file you must be aware of the presence of undesired characters after php end tag.

    Let's take an example:
    > page.php
    <?php
    include_once 'i_have_php_end_tag.inc.php';
    include_once     'init_session.inc.php';

    echo     "Damn! Why I'm having these output header errors?";
    ?>

    > i_have_php_end_tag.inc.php
    <?php
    $_JUST_A_GLOBAL_VAR     = 'Yes, a global var, indeed';
    ?>

    > init_session.inc.php
    <?php
    session_start    ();
    $_SESSION['blabla'] = 123;
    ?>

    With all this stuff we will get an error, something like:
    "... Cannot send session cache limiter - headers already sent (output started at ...", right?

    To solve this problem we have to ignore all output sent by include files. To ensure that we need to use the couple of functions: *ob_start()* and *ob_end_clean()* to suppress the output. So, all we have to do is changing the *page.php* to this:

    <?php
    ob_start    ();
    include_once     'i_have_php_end_tag.inc.php';
    include_once     'init_session.inc.php';
    ob_end_clean();

    echo     "Woo hoo! All right! Die you undesired outputs!!!";
    ?>
    up
    -4
    james at skinsupport dot com
    19 years ago
    One thing of note that caused me three days of trouble:

    It's important to note that Firefox (for one) makes two calls to the server automatically. One for the page, and one for favicon.ico.

    If you are setting session variables (as I was) to certain values when a page exists, and other values when pages don't exist, the values for non-existent pages will overwrite the values for existing pages if favicon.ico doesn't exist.

    I doubt many of you are doing this, but if you are, this is a consideration you need to address or you'll be bald over the course of a three day period!
    ＋Добавить
    To Top