Configuring for session handling

Configuring for session handling

When I start breaking down the code, you will see the exact functions you need to work with sessions. But while you are reading about configuration options, it’s best

Chapter 14: Shopping Cart 373

to cover the different ways sessions can be implemented in PHP. But first a little on what sessions in PHP actually do.

Say you want to track the activity of your users across a number of pages, as with this shopping cart. You need to remember who has put what in a cart. To accomplish this, you could pass some rather complex variables via a cookie that held the all of the elements and their prices. But this is kind of messy, and it may expose more of the workings of your application than you are comfortable exposing. Moreover, the cookie specification ( http://www.netscape.com/newsref/std/cookie_spec.html ) allows for only 20 cookies per domain and only 4 bytes per cookie.

A better idea is give each person who visits your site a unique identifier, some value that identifies who that person is. Then, as the user adds items to the cart, information associated with the unique identifier can be stored on the server. If you were to code a function that stored the information by hand, you might create a unique string that would be put in a cookie; then, in some directory on the server, you could have a file that has the same name as the unique user ID. Within that file you could store all the variables associated with the user. For example, you might have an array of items that a specific user put in his or her cart.

In fact, this is almost exactly what sessions do. When you indicate in your code (or by settings in your php.ini) that you’d like to start a session, PHP will create a unique identifier and an associated file, which is stored on the server (the location is set in the php.ini, and by default is in the /tmp directory). Then as a user moves from page to page, all the variable information that the user chooses can be stored in the file on the server, and all the script needs to keep track of is the unique identifier.

There are many configuration options when it comes to sessions, but probably the most important decision is where the session id will be propagated, in a URL or in a cookie. Most e-commerce sites make use of cookies. However, there is the chance that some of your users will not be able to use your site properly if they have their browsers set to reject cookies. For this reason, in PHP it is very easy to add the session id to the querystring. There are two ways to go about it.

The code <?= SID ?> will print the session id. To append the session id to a URL, you would have to manually add it, like this:

<a href=mydomain.com?sid=<?=SID?> This can make for some tedious work if you want to put the session id on every

link in your site. However, if you compile PHP with the flag --enable-trans-sid , the session id will be automatically appended to every relative link in your pages once a session has been started.