Session in MySQL Database

[micha8l]

Hey guys,

 

I'm working a project that requires sessions be stored within the database, as the project I'm working on is on a shared host. But I'm having a problem with getting the data of a session in the database, the other fields like session_id, session_updated, session_created are working fine. I think I've got a bug in my code, but I just can't detect it (frustrating).

 

Database connection

class db extends mysqli {
private $host;
private $user;
private $pass;
private $db;

function __construct( $host='localhost', $user='user', $pass='pass', $db='website' ) {
	$this -> host = $host;
	$this -> user = $user;
	$this -> pass = $pass;
	$this -> db = $db;

	parent::connect( $host, $user, $pass, $db );

	if( mysqli_connect_error( ) ) {
		die( 'Connection error ('.mysqli_connect_errno(  ).'): '.mysqli_connect_error(  ) );
	}

}

function __destruct(  ) {
	$this -> close(  );
}
}

 

Session handler

class sessionHandler {
private $database;
private $dirName;
private $sessTable;
private $fieldArray;

    function sessionHandler() {
        // save directory name of current script
	$this -> database = new db;
        $this -> dirName = dirname(__file__);
        $this -> sessTable = 'sessions';
    }

    function open( $save_path, $session_name ) {
	return TRUE;
    }

    function close() {
	//close the session.
        if ( !empty( $this -> fieldarray ) ) {
            // perform garbage collection
            $result = $this->gc( ini_get ( 'session.gc_maxlifetime' ) );
            return $result;
        }
        return TRUE;
    }

    function read( $session_id ) {
	$sql = "
	SELECT *
	FROM sessions
	WHERE session_id=( '$session_id' )
	LIMIT 1
	";
	$result = $this -> database -> query( $sql );
	if( $result -> num_rows > 0  ) {
		$data = $result -> fetch_array( MYSQLI_ASSOC );
		$this -> fieldArray = $data;
		$result -> close();
		return $data;
	}
	return "";
    }

    function write( $session_id, $session_data ) {
	//write session data to the database.
        if ( !empty( $this -> fieldArray ) ) {
            if ( $this -> fieldArray['session_id'] != $session_id ) {
                // user is starting a new session with previous data
                $this -> fieldArray = array();
            }
        }

	$this -> fieldArray['session_id'] = $session_id;
	$this -> fieldArray['session_data'] = $session_data;
	$this -> fieldArray['session_updated'] = time();
	$this -> fieldArray['session_created'] = time();

	$session_id = $this -> database -> escape_string( $session_id );
	$session_data = $this -> database -> escape_string( $session_data );
	$session_updated = time();
	$session_created = time();	

	$sql = "
	INSERT INTO sessions ( session_id, session_data, session_updated, session_created )
	VALUES ( '$session_id', '$session_data', '$session_updated', '$session_created' )
	";
	if( $this -> database -> query( $sql ) !== TRUE ) {
		return FALSE;
	}
	return TRUE;
    }

    function destroy( $session_id ) {
	$sql = "
	DELETE FROM sessions
	WHERE session_id=('$session_id')
	";
	if( $this -> database -> query( $sql ) !== TRUE ) {
		return FALSE;
	}
	return TRUE;
    }

    function gc( $max_lifetime ) {
	return TRUE;
    }

    function __destruct() {
	//ensure session data is written out before classes are destroyed
	//(see http://bugs.php.net/bug.php?id=33772 for details)
	@session_write_close();
    }
}

 

The call

$session_class = new sessionHandler;
session_set_save_handler(
array( &$session_class, 'open' ),
array( &$session_class, 'close' ),
array( &$session_class, 'read' ),
array( &$session_class, 'write' ),
array( &$session_class, 'destroy' ),
array( &$session_class, 'gc' )
);
if( !session_start() ) {
exit();
}

 

Any help at all would be appreciated.

 

Kind Regards

Mike

[PFMaBiSmAd]

  Quote

...is on a shared host.

 

All you need to do is set the session.save_path to be to a 'private' folder within your account's folder tree.

[micha8l]

Thanks for the reply man. The method (no pun) isn't just about security though, as some other methods in the project are going to depend on it.

[PFMaBiSmAd]

Your code works for me (inserts the $session_data into the table), provided you actually set a session variable.

 

BTW: You are going to want to use a REPLACE query instead of an INSERT query.