Yes, as freakysid stated I usually store my session data in a databse instead of files, for faster manipulation of session data. With that I wrote my own session handling functions, that basically tell PHP how to handle sessions natively.
When a user logs out I delete the record from the database. So if they use the back button it doesn't matter since I check for a session variable, if its not present I simply send them to the login screen. Here is the session handling functions. They require PHPLIB's mysql class.
PHP Code:
########################## session handling crap ###############################
$sess_lifetime = get_cfg_var("session.gc_maxlifetime");
function sess_open() {
global $db;
return $db;
}
function sess_close() {
return true;
}
function sess_read($key) {
global $db;
$db->query(sprintf("SELECT value FROM sess WHERE sesskey = '%s' AND expire > %s", $key, time()));
if ($db->num_rows() > 0) {
$db->next_record();
return $db->f(value);
}
else {
return false;
}
}
function sess_write($key,$val) {
global $db, $sess_lifetime;
$expire = time() + $sess_lifetime;
$value = addslashes($val);
$db->query(sprintf("UPDATE sess SET expire = %s, value = '%s' WHERE sesskey = '%s' AND expire > %s", $expire, $value, $key, time()));
if ($db->affected_rows() < 1) {
$db->query(sprintf("INSERT into sess SET sesskey = '%s', expire = %s, value = '%s'", $key, $expire, $value));
}
return $db->affected_rows();
}
function sess_destroy($key) {
global $db;
$db->query(sprintf("DELETE from sess WHERE sesskey = '%s'", $key));
return $db->affected_rows();
}
function sess_gc() {
global $db, $sess;
session_unset();
$db->query(sprintf("DELETE from sess WHERE sesskey = '%s'", $sess));
return $db->affected_rows();
}
session_set_save_handler(
"sess_open",
"sess_close",
"sess_read",
"sess_write",
"sess_destroy",
"sess_gc");
Here is the db schema
+---------+------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+---------+------------------+------+-----+---------+-------+
| sesskey | varchar(32) | | PRI | | |
| expire | int(11) unsigned | | | 0 | |
| value | text | | | | |
+---------+------------------+------+-----+---------+-------+
Bookmarks