; is necessary to preserve the session id # in the case that the user has disabled cookies ?> To continue, click here ]]> The <?=SID?> is not necessary, if --enable-trans-sid was used to compile PHP. Non-relative URLs are assumed to point to external sites and hence don't append the SID, as it would be a security risk to leak the SID to a different server. To implement database storage, or any other storage method, you will need to use session_set_save_handler to create a set of user-level storage functions. The session management system supports a number of configuration options which you can place in your php.ini file. We will give a short overview. session.save_handler defines the name of the handler which is used for storing and retrieving data associated with a session. Defaults to files. session.save_path defines the argument which is passed to the save handler. If you choose the default files handler, this is the path where the files are created. Defaults to /tmp. If you leave this set to a world-readable directory, such as /tmp (the default), other users on the server may be able to hijack sessions by getting the list of files in that directory. session.name specifies the name of the session which is used as cookie name. It should only contain alphanumeric characters. Defaults to PHPSESSID. session.auto_start specifies whether the session module starts a session automatically on request startup. Defaults to 0 (disabled). session.cookie_lifetime specifies the lifetime of the cookie in seconds which is sent to the browser. The value 0 means "until the browser is closed." Defaults to 0. session.serialize_handler defines the name of the handler which is used to serialize/deserialize data. Currently, a PHP internal format (name php) and WDDX is supported (name wddx). WDDX is only available, if PHP is compiled with WDDX support. Defaults to php. session.gc_probability specifies the probability that the gc (garbage collection) routine is started on each request in percent. Defaults to 1. session.gc_maxlifetime specifies the number of seconds after which data will be seen as 'garbage' and cleaned up. session.referer_check contains the substring you want to check each HTTP Referer for. If the Referer was sent by the client and the substring was not found, the embedded session id will be marked as invalid. Defaults to the empty string. session.entropy_file gives a path to an external resource (file) which will be used as an additional entropy source in the session id creation process. Examples are /dev/random or /dev/urandom which are available on many Unix systems. session.entropy_length specifies the number of bytes which will be read from the file specified above. Defaults to 0 (disabled). session.use_cookies specifies whether the module will use cookies to store the session id on the client side. Defaults to 1 (enabled). session.cookie_path specifies path to set in session_cookie. Defaults to /. session.cookie_domain specifies domain to set in session_cookie. Default is none at all. session.cache_limiter specifies cache control method to use for session pages (nocache/private/private_no_expire/public). Defaults to nocache. session.cache_expire specifies time-to-live for cached session pages in minutes, this has no effect for nocache limiter. Defaults to 180. session.use_trans_sid whether transparent sid support is enabled or not if enabled by compiling with --enable-trans-sid. Defaults to 1 (enabled). url_rewriter.tags spefifies which html tags are rewritten to include session id if transparent sid support is enabled. Defaults to a=href,area=href,frame=src,input=src,form=fakeentry Session handling was added in PHP 4.0. session_start Initialize session data bool session_start session_start creates a session (or resumes the current one based on the session id being passed via a GET variable or a cookie). If you want to use a named session, you must call session_name before calling session_start. This function always returns &true;. If you are using cookie-based sessions, you must call session_start before anything is output to the browser. session_destroy Destroys all data registered to a session bool session_destroy session_destroy destroys all of the data associated with the current session. It does not unset any of the global variables associated with the session, or unset the session cookie. This function returns &true; on success and &false; on failure to destroy the session data. ]]> session_name Get and/or set the current session name string session_name string name session_name returns the name of the current session. If name is specified, the name of the current session is changed to its value. The session name references the session id in cookies and URLs. It should contain only alphanumeric characters; it should be short and descriptive (i.e. for users with enabled cookie warnings). The session name is reset to the default value stored in session.name at request startup time. Thus, you need to call session_name for every request (and before session_start or session_register are called). "; ?> ]]> session_module_name Get and/or set the current session module string session_module_name string module session_module_name returns the name of the current session module. If module is specified, that module will be used instead. session_save_path Get and/or set the current session save path string session_save_path string path session_save_path returns the path of the current directory used to save session data. If path is specified, the path to which data is saved will be changed. On some operating systems, you may want to specify a path on a filesystem that handles lots of small files efficiently. For example, on Linux, reiserfs may provide better performance than ext2fs. session_id Get and/or set the current session id string session_id string id session_id returns the session id for the current session. If id is specified, it will replace the current session id. The constant SID can also be used to retrieve the current name and session id as a string suitable for adding to URLs. session_register Register one or more variables with the current session bool session_register mixed name mixed ... session_register accepts a variable number of arguments, any of which can be either a string holding the name of a variable or an array consisting of variable names or other arrays. For each name, session_register registers the global variable with that name in the current session. This registers a global variable. If you want to register a session variable inside a function, you need to make sure to make it global using global or use the session arrays as noted below. This function returns &true; when all of the variables are successfully registered with the session. If session_start was not called before this function is called, an implicit call to session_start with no parameters will be made. You can also create a session variable by simply setting the appropriate member of the $HTTP_SESSION_VARS or $_SESSION (PHP >= 4.1.0) array. It is not currently possible to register resource variables in a session. For example, you can not create a connection to a database and store the connection id as a session variable and expect the connection to still be valid the next time the session is restored. PHP functions that return a resource are identified by having a return type of resource in their function definitions. A list of functions that return resources are available in the resource types appendix. See also session_is_registered and session_unregister. session_unregister Unregister a variable from the current session bool session_unregister string name session_unregister unregisters (forgets) the global variable named name from the current session. This function returns &true; when the variable is successfully unregistered from the session. This function doesn't unset the corresponding global variable for name, it only prevents the variable from being saved as part of the session. You must call unset to remove the corresponding global variable. session_unset Free all session variables void session_unset The session_unset function free's all session variables currently registered. session_is_registered Find out if a variable is registered in a session bool session_is_registered string name session_is_registered returns &true; if there is a variable with the name name registered in the current session. session_get_cookie_params Get the session cookie parameters array session_get_cookie_params The session_get_cookie_params function returns an array with the current session cookie information, the array contains the following items: "lifetime" - The lifetime of the cookie. "path" - The path where information is stored. "domain" - The domain of the cookie. "secure" - The cookie should only be sent over secure connections. (This item was added in PHP 4.0.4.) session_set_cookie_params Set the session cookie parameters void session_set_cookie_params int lifetime string path string domain Set cookie parameters defined in the php.ini file. The effect of this function only lasts for the duration of the script. session_decode Decodes session data from a string bool session_decode string data session_decode decodes the session data in data, setting variables stored in the session. session_encode Encodes the current session data as a string string session_encode session_encode returns a string with the contents of the current session encoded within. session_set_save_handler Sets user-level session storage functions void session_set_save_handler string openstring closestring readstring writestring destroystring gc session_set_save_handler sets the user-level session storage functions which are used for storing and retrieving data associated with a session. This is most useful when a storage method other than those supplied by PHP sessions is preferred. i.e. Storing the session data in a local database. You must set the configuration option session.save_handler to user in your php.ini file for session_set_save_handler to take effect. The "write" handler is not executed until after the output stream is closed. Thus, output from debugging statements in the "write" handler will never be seen in the browser. If debugging output is necessary, it is suggested that the debug output be written to a file instead. The following example provides file based session storage similar to the PHP sessions default save handler files. This example could easily be extended to cover database storage using your favorite PHP supported database engine. ]]> session_cache_limiter Get and/or set the current cache limiter string session_cache_limiter string cache_limiter session_cache_limiter returns the name of the current cache limiter. If cache_limiter is specified, the name of the current cache limiter is changed to the new value. The cache limiter controls the cache control HTTP headers sent to the client. These headers determine the rules by which the page content may be cached. Setting the cache limiter to nocache, for example, would disallow any client-side caching. A value of public, however, would permit caching. It can also be set to private, which is slightly more restrictive than public. In private mode, Expire header sent to the client, may cause confusion for some browser including Mozilla. You can avoid this problem with private_no_expire mode. Expire header is never sent to the client in this mode. private_no_expire was added in PHP 4.2.0dev. The cache limiter is reset to the default value stored in session.cache_limiter at request startup time. Thus, you need to call session_cache_limiter for every request (and before session_start is called). "; ?> ]]> session_cache_expire Return current cache expire int session_cache_expire int new_cache_expire session_cache_expire returns current cache expire. If new_cache_expire is given, the current cache expire is replaced with new_cache_expire. session_write_close Write session data and end session void session_write_close End the current session and store session data. Session data is usually stored after your script terminated without the need to call session_write_close, but as session data is locked to prevent concurrent writes only one script may operate on a session at any time. When using framesets together with sessions you will experience the frames loading one by one due to this locking. You can reduce the time needed to load all the frames by ending the session as soon as all changes to session variables are done.