PHP Sessions
session_start() Options
Starting with PHP Sessions we can pass an array with session-based php.ini options to the session_start function.
Example
<?php
if (version_compare(PHP_VERSION, '7.0.0') >= 0) {
// php >= 7 version
session_start([
'cache_limiter' => 'private',
'read_and_close' => true,
]);
} else {
// php < 7 version
session_start();
}
?>This feature also introduces a new php.ini setting named session.lazy_write, which defaults to true and means that session data is only rewritten, if it changes.
Session Locking
As we all are aware that PHP writes session data into a file at server side. When a request is made to php script which starts the session via session_start(), PHP locks this session file resulting to block/wait other incoming requests for same session_id to complete, because of which the other requests will get stuck on session_start() until or unless the session file locked is not released
The session file remains locked until the script is completed or session is manually closed. To avoid this situation i.e.
to prevent multiple requests getting blocked, we can start the session and close the session which will release the lock from session file and allow to continue the remaining requests.
// php < 7.0
// start session
session_start();
// write data to session
$_SESSION['id'] = 123;Output
session file is locked, so other requests are blocked
// close the session, release lock
session_write_close();Now one will think if session is closed how we will read the session values, beautify even after session is closed, session is still available. So, we can still read the session data.
echo $_SESSION['id'];Output
123
In php >= 7.0, we can have read_only session, read_write session and lazy_write session, so it may not required to use
session_write_close()
Destroy an entire session
If you've got a session which you wish to destroy, you can do this with session_destroy()
/*
Let us assume that our session looks like this:
Array([firstname] => Jon, [id] => 123)
We first need to start our session:
*/
session_start();
/*
We can now remove all the values from the `SESSION` superglobal:
If you omitted this step all of the global variables stored in the
superglobal would still exist even though the session had been destroyed.
*/
$_SESSION = array();
// If it's desired to kill the session, also delete the session cookie.
// Note: This will destroy the session, and not just the session data!
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000,
$params["path"], $params["domain"],
$params["secure"], $params["httponly"]
);
}
//Finally we can destroy the session:
session_destroy();Using session_destroy() is different to using something like $_SESSION = array(); which will remove all of the values stored in the SESSION superglobal but it will not destroy the actual stored version of the session.
Note: We use $_SESSION = array(); instead of session_unset() because the manual stipulates: Only use session_unset() for older deprecated code that does not use $_SESSION.
Session name
Checking if session cookies have been created
Session name is the name of the cookie used to store sessions. You can use this to detect if cookies for a session have been created for the user:
if(isset($_COOKIE[session_name()])) {
session_start();
}Note that this method is generally not useful unless you really don't want to create cookies unnecessarily.
Changing session name
You can update the session name by calling session_name().
//Set the session name
session_name('newname');
//Start the session
session_start();If no argument is provided into session_name() then the current session name is returned. It should contain only alphanumeric characters; it should be short and descriptive (i.e. for users with enabled cookie warnings). The session name can't consist of digits only, at least one letter must be present. Otherwise a new session id is generated every time.