Member Avatar for ashneet

First of all i am new to PHP Session.
THE PROBLEM:
I do session_start(); command at the begening of every page so that php uses session but what i also what it to do is that if that person closes the browser and returns back to same website it should atleast pick up the person's user name so that they dont have to type it again and again when ever they come back. plus to that every single time that person close the browser and come back to that website it creates a new session which is painful as each session take space on the webserver. any idea on how to get the php to get the session id of an old session that was made by the same website and run that session if it is available. any tips on session is good as i was not able to find good documentation on php.net regarind this problem.

  • 3 Contributors
  • 3 Replies
  • 190 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by ashneet

Dani AI

Generated

Short answer: use a persistent "remember me" cookie (a random token) to re-create a session when the browser is reopened, and keep normal PHP sessions for the active logged-in state. was right to point toward cookies, and ’s reminder about cookie timing is useful — but for a robust solution you should avoid storing credentials in the cookie and manage server-side state securely.

How to implement (high level):

  • On successful login with "remember me" checked, generate a cryptographically strong random token, store only a hashed copy of that token in a small DB table with user_id and expiry, then set a long-lived cookie containing the raw token. Make the cookie Secure (HTTPS-only), HttpOnly, and set an appropriate SameSite value. Don’t put passwords in cookies.
  • On each request: if there’s no active session but the remember cookie exists, look up the hashed token in the DB, verify expiry (and optionally user-agent/IP heuristics), then create a fresh session for that user and regenerate the session id. Rotate the remember token periodically (issue a new token and delete the old DB row) to reduce theft risk.
  • On logout or token expiry remove the DB token and expire the cookie immediately.

Why sessions keep being recreated and server space grows:

  • Browsers usually discard session cookies when closed, so PHP will make a new session on return unless a persistent cookie is used.
  • Server-side session files persist until PHP’s garbage collector removes them. If that’s a problem, either tune PHP’s session garbage-collection settings or store sessions in a DB/memcached/Redis via a custom session handler to avoid many leftover files.

Quick troubleshooting tips:

  • Verify cookies are actually set (browser dev tools), check cookie domain/path, and ensure set-cookie happens before any output. Test with and without HTTPS. Log token creation/validation events when debugging.
    Security notes: always use HTTPS for authentication flows, never store raw passwords in cookies, and keep remember-token lifetimes reasonable (e.g., days to a few weeks), with server-side revocation available.

Recommended Answers

All 3 Replies

Member Avatar for bwest

I think you should use cookies. I also think you should look at this script. The top of this page has a great php login with session handling and cookies for automatic re-login. I have the link here though to my comment on the script that will have some extra stuff

http://www.mt-dev.com/2002/07/creating-a-secure-php-login-script/#comment-4746
<go to top of page to see origonal code>

The original code is good but requires a PEAR connection to a mysql db. I don’t use PEAR so I re-wrote the script with some small changes. that’s why I want you to go to my comment because you can download the whole class instead of putting their puzzle peaces together

Brad

Member Avatar for fsn812

From Zend:

==
Chapter 35. Cookies

PHP transparently supports HTTP cookies. Cookies are a mechanism for storing data in the remote browser and thus tracking or identifying return users. You can set cookies using the setcookie() or setrawcookie() function. Cookies are part of the HTTP header, so setcookie() must be called before any output is sent to the browser. This is the same limitation that header() has. You can use the to delay the script output until you have decided whether or not to set any cookies or send any headers.

Any cookies sent to you from the client will automatically be turned into a PHP variable just like GET and POST method data, depending on the and configuration variables. If you wish to assign multiple values to a single cookie, just add [] to the cookie name.

In PHP 4.1.0 and later, the $_COOKIE auto-global array will always be set with any cookies sent from the client. $HTTP_COOKIE_VARS is also set in earlier versions of PHP when the configuration variable is set. (This setting is always on since PHP 4.0.3.)

For more details, including notes on browser bugs, see the setcookie() and setrawcookie() function.

==

Furthermore, check out the setcookie function information provided by PHP.NET.

A few examples that may help you start in the right direction (taken from the setcookie php.net link above):

Example 1. setcookie() send example  <?php
$value = 'something from somewhere';

setcookie("TestCookie", $value);
setcookie("TestCookie", $value, time()+3600);  /* expire in 1 hour */
setcookie("TestCookie", $value, time()+3600, "/~rasmus/", ".example.com", 1);
?>
Example 2. setcookie() delete example  <?php
// set the expiration date to one hour ago
setcookie ("TestCookie", "", time() - 3600);
setcookie ("TestCookie", "", time() - 3600, "/~rasmus/", ".example.com", 1);
?>
Example 3. setcookie() and arrays  <?php
// set the cookies
setcookie("cookie[three]", "cookiethree");
setcookie("cookie[two]", "cookietwo");
setcookie("cookie[one]", "cookieone");

// after the page reloads, print them out
if (isset($_COOKIE['cookie'])) {
    foreach ($_COOKIE['cookie'] as $name => $value) {
	    echo "$name : $value <br />\n";
    }
}
?>

Past that, try googling for 'PHP cookie' or 'PHP session' tutorials. ;)

Member Avatar for ashneet

Thanks for all the help i will try all of these examples and see what works the best..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.