Hi, I'm realtively new to PHP and I'm considering creating some login functionality. However I want a group of users to use the same loginname and password. They will be loggin infrom different machines. The users will know they are sharing the account. Can anyone give me an idea of what kind of effect this might have on my sessions? Will it create any odd hiccups or other strange things?

Reply

Session allows you to preserve data across page requests (going from one page to another on a website) by saving the data to variables that you register as being part of a session. Sessions are tracked through
cookies or through the URL. I prefer to track sessions through the URL because cookies may not be enabled on the client computer.

If PHP is compiled with --enable-trans-sid then URLs will contain the session id automatically via the constant PHPSESSID.

Function session_start(void):
Looks for an existing session and if one does not exist, it creates a session. If a session already exists it resumes the current one [sets the session variables for the page] based on the session id being passed via a GET variable [the URL] or a cookie). This function always returns TRUE.

Function session_id([string id]):
Get and and returns the session id for the current session. If a session id is specified, it will replace the current session id with the specified id. If you assign a session id on your own you should call the session_id() function before starting a session. Your custom session id cannot have whitespaces, underscores(_) or periods (.).

PHP Code
$id = 445785931;
session_id($id);
session_start();

Function session_register(mixed name [, mixed ...]):
Registers one or more variables with the current session, either a string holding the name of a variable or an array consisting of variable names or other arrays. For each name, session_register() registers a global variable with that name in the current session. This function returns TRUE when all of the variables are successfully registered with the session.

Function session_is_registered(string name):
Determines if a variable is registered in a session. This function returns TRUE if there is a variable with the name registered in the current session.

Function session_unregister(string name):
Unregisters a specific variable from the current session. The variable will no longer be saved as part of the session. This function returns TRUE when the variable is successfully unregistered from the session.

Function session_unset(void):
Free all session variables that are registered for the current session. The variables can be re-registered by calling session_register().

Function session_destroy(void):
Destroys all data registered to a session. This function returns TRUE on success and FALSE on failure to destroy the session data.

Further reading PHP: Manual: Session handling functions

The following example demonstrates how to create a session variable on one page, then redirect the user to another page and passing the session id variable thru a querystring to the next page. Then the next
page will do a detection to see if the value of the SessionID Querystring is the same as the actual session_id().

PHP Code
<?
// start session
session_start();

if(!session_is_registered("favcolour")) {

// assign a value to the favorite colour variable
$favcolour = "purple";

// register the favorite colour variable as a session variable
session_register('favcolour');

// assign the sessionID to a variable
//$seshID = session_id();
?>
<A HREF="<? echo "$PHP_SELF?=SID"; ?>">click here</A>
<?
} else {
// print the value of the favorite colour session variable
print "<p>Session Variable (favcolour) was successfully registered: ". $HTTP_SESSION_VARS['favcolour'];

// print the value of the SessionID Querystring Variable (represents the sessionID
print "<p>Session ID (session_ID()): ". session_id();
print "<p>Session ID (SID): ". $SID;


if ($SID != session_id()) {
print "<p>SID is NOT equal to session_id()";
} else {
print "<p>SID is equal to session_id()";
}

session_unregister('favcolour');
if(!session_is_registered("favcolour")) {
print "<p>Session Variable (favcolour) was successfully unregistered!</p>";
} else {
print "<p>Session Variable (favcolour) was NOT successfully unregistered!</p>";
}

//unset all session variables
session_unset();

//destroy session
session_destroy();
}
?>



The output results should look something like so:

Session Variable (favcolour) was successfully registered: purple

SID (session_ID()): c95a9b59ad06409627bbfd92aea7aa92

SID ($SessionID): c95a9b59ad06409627bbfd92aea7aa92

SID is equal to session_id()

Session Variable (favcolour) was successfully unregistered!

 

 

 

Reply

it's really not a problem if you are not going to keep track of their ip adresses.

Reply