Webmaster in a Nutshell, Third Edition

Sessions

Sessions are used to help maintain the values of variables across multiple web pages. This is done by creating a unique session ID that is sent to the client browser. The browser then sends the unique ID back on each page request and PHP uses the ID to fetch the values of all the variables associated with this session.

The session ID is sent back and forth in a cookie or in the URL. By default, PHP tries to use cookies, but if the browser has disabled cookies, PHP falls back to putting the ID in the URL. The php.ini directives that affect this are:

session.use_cookies

When on, PHP will try to use cookies

session.use_trans_sid

When on, PHP will add the ID to URLs if cookies are not used

The trans_sid code in PHP is rather interesting. It actually parses the entire HTML file and modifies/mangles every link and form to add the session ID. The url_rewriter.tags php.ini directive can change how the various elements are mangled.

Writing an application that uses sessions is not hard. You start a session using session_start( ), then register the variables you wish to associate with that session. For example:

<?php
  session_start( );
  session_register('foo');
  session_register('bar');

  $foo = "Hello";
  $bar = "World";
?>

If you put the previous example in a file named page1.php and load it in your browser, it sends you a cookie and stores the values of $foo and $bar on the server. If you then load this page2.php page:

<?php session_start( ); echo "foo = $_SESSION[foo]<br />"; echo "bar ...