This document discusses session management in PHP. It explains that PHP sessions and cookies allow for persistence in HTTP, which is otherwise stateless. Sessions store user information on the server and allow sharing data across requests. The session ID associates a user's requests. Sessions are created via session_start() and values are stored in the $_SESSION superglobal array and retrieved the same way. Sessions can be destroyed via session_destroy() but are normally left to timeout. An example increments a session variable to count page accesses.

1. SESSION
MANAGEMENT IN PHP
PREPARED BY-RIYA SHAH
TY CE-2
BATCH-C
SEM-6
EN NO:170410107108
SUBJECT:WEB TECHNOLOGY
CODE:2160708
COLLEGE:SVIT,VASAD

2. Persistence and HTTP
Recall http is a stateless protocol. It remembers nothing about previous
transfers.
PHP sessions and cookies are mechanisms for introducing state into
HTTP transactions.
Two ways to achieve persistence:
 PHP cookies
 PHP sessions
HTTP
serverClient
Cookie
Session

3. What is a Session?
Sessions is information that relates a user and is stored on the
server. A session will no longer exist once the browser closes.
Sessions do not have a size limit. Sensitive information should be
stored in the session.The session support allows you to register
arbitrary numbers of variables to be preserved across requests.This
enables you to build more customized applications and increase the
appeal of your web site.
User saves session information
User retrieves session infomration

4. What is a Session?
We can store user’s information (e.g. username, items selected, etc.)
in the server side for later use using PHP session.
For e.g. Shopping cart or login information is stored in the session in
the server.
Advantages of Session -
 Without session management:
users would have to constantly re-authenticate
 With session management:
Authorize user once
All subsequent requests are tied to user
Session Tracking – keeping track of users as they traverse from one
web page (generated from a script) to another within a website (or
within a web application).
Attacker waits for user to login then attacker obtains user’s Session
Token and “hijacks” session.

5. How Session Works?
 The first time a web client visits a server, the server sends a unique
"session ID" to the web client for the client and stores the variables
based on this UID.
 Session ID is typically stored in the cookies or is propagated in
the URL.
 The session ID is used by the server to identify the client.
 For each session ID created, the server also creates a storage
space. Server-side scripts that receive the same session ID share
the same storage space.
 The storage space is typically implemented as a map-liked data
structure.
 In PHP, it is an associative array named $_SESSION[].
 A session's "storage space" is only kept alive for a period of time
(session period) or until it is explicitly deleted.

6. How to Create a Session?
The session_start() function is used to create cookies.
<?php
session_start();
?>
• This tells PHP that a session is requested.
• A session ID is then allocated at the server end.
• session ID looks like:
sess_f1234781237468123768asjkhfa7891234g

7. How to Retrieve a Session Value?
Session variables
 $_SESSION
 e.g., $_SESSION[“intVar”] = 10;
 Testing if a session variable has been set:
session_start();
if(!$_SESSION['intVar']) {...} //intVar is set or not
For eg <?php
session_start();
if (!isset($_SESSION['count']))
$_SESSION['count'] = 0;
else
$_SESSION['count']++;
?>

8. Registering session variables
 With session_start() a default session variable is created - the
name extracted from the page name.
 To create your own session variable just add a new key to the
$_SESSION super global.
 $_SESSION[‘dug’] = “a talking dog.”;
 Instead of setting super global, one can register one’s own session
variables.
<?php
$barney = “A big purple dinosaur.”;
$myvar_name = “barney”;
session_register($myvar_name);
?>
• $barney can now be accessed “globally” from session to session.
 This only works if the register_globals directive is enabled in
php.ini - nowadays this is turned off by default.
 Use of session_register() is deprecated!
 Use of $_SESSION is preferred, as of PHP 4.1.0.

9. Storing And Reading Session Data
• The $_SESSION super global array can be used to store any
session data.
$_SESSION['name'] = $name;
$_SESSION['age'] = $age;
• Data is simply read back from the
$_SESSION super global array.
$name =$_SESSION['name'];
$age = $_SESSION['age'];

10. How to Delete a Session
Value?
session_unregister(´varname´);
unset($_SESSION[‘name’])
– Remove a session variable
How to destroy a session:
session_destroy()
– Destroys all data registered to a session
– does not unset session global variables and cookies
associated with the session
– Not normally done - leave to timeout

11. Session Example :
<?php
 session_start();
 if (!isset($_SESSION["intVar"]) ){
 $_SESSION["intVar"] = 1;
 } else {
 $_SESSION["intVar"]++;
 }
 echo "<p>In this session you have accessed this page " .
$_SESSION["intVar"] . "times.</p>";
 ?>

12. THANK YOU