sessions keeps logging me out!

[runnerjp]

im on a host server and  i cant access the php.ini file to change the session's... after around 30/40 min of users not been active the sessions expire...

 

the problem is if a user is still on the page when the sessions expire and they make a post in the forum then they can still post it but obviusly as the sessions have ran out then only the post is made and the username ect is blank!

this also effects how i track users on pages as if they refresh the page when they are on it then it records them as blank and i get an output of e.g  admin,, (inbetween ,, is nothing as the person on the page has no sessions to record there user name)

 

so what can u guys suggest?

[Adam]

Could create a javascript / ajax script to every say, 20 minutes kind of 'ping' the webserver and keep the session alive?

 

Adam

[JasonLewis]

When they hit the post button ensure that the sessions are still set. If not, tell them to log in again. Isn't that the logical option?

[runnerjp]

ohhh never throught about that one!

 

how would i check if they are logged in via hitting the submit button? would this be on the page where i submit the data to the db or would it be actually wihtin the submit button area?

[JasonLewis]

Where you submit the data. Before you do any processing of the data from the form, check if the session is set.

 

if(isset($_SESSION['username_session'])){
//process form
}else{
//redirect to login with message about inactivity
}

[runnerjp]

ahh thanks!... but what about grabbing users on the page that arnt currently logged in due to the session timeout?

[JasonLewis]

I'm not quite sure what you mean. Could you please explain a bit more.

[runnerjp]

well basicly i log the users on my page via

 

function selfURL() { 
$s = empty($_SERVER["HTTPS"]) ? '' : ($_SERVER["HTTPS"] == "on") ? "s" : "";
$protocol = strleft(strtolower($_SERVER["SERVER_PROTOCOL"]), "/").$s; 
$port = ($_SERVER["SERVER_PORT"] == "80") ? "" : (":".$_SERVER["SERVER_PORT"]); 
return $protocol."://".$_SERVER['SERVER_NAME'].$port.$_SERVER['REQUEST_URI']; } 
function strleft($s1, $s2) { return substr($s1, 0, strpos($s1, $s2)); }
$filename = (selfURL());
//Insert User
$insert = mysql_query("REPLACE INTO `useronline` SET `timestamp`='$timestamp', `ip`='".$_SERVER['REMOTE_ADDR']."', `file`='$filename',`user`='$username',`user_id`='".$_SESSION['user_id']."'") 
or die(mysql_error()); 

 

so if a users trys to access the page and is not logged in it saves it as "" (blank) but still records there info like ip ect..

[JasonLewis]

On each page that is available only to users you should be ensuring that they are indeed a user, by checking the session variable. Otherwise I could go to your website and not register but access member restricted pages.