A PHP session stores user-specific data on the server, providing security and persistence across pages. 1. When session_start() is called, PHP generates a unique session ID. 2. This ID is stored in a client-side cookie and used to retrieve server-stored session data. 3. Session variables are accessed via the $_SESSION array for tracking login status, preferences, or cart contents. 4. Ending a session requires unsetting variables with $_SESSION = [] and calling session_destroy(). 5. Common issues include incorrect session start placement, inconsistent domains, timeout settings, and storing sensitive data in sessions.

A PHP session is a way to store information (in variables) across multiple pages for a specific user. Unlike cookies, which store data on the client side, sessions store data on the server, making them more secure and reliable for handling sensitive or temporary user-specific information.

How PHP Sessions Work

When a session starts, PHP creates a unique identifier (called a session ID) for that user. This ID is stored in a cookie on the user’s browser and used to associate the user with their session data on the server.

Here’s what happens behind the scenes:

• You call session_start() at the beginning of your script.
• PHP checks if there's a session ID in the request. If not, it creates a new one.
• The session data is stored in a file (or other storage mechanism configured on the server).
• Each time the user makes a request, PHP retrieves the session data based on the session ID and makes it available via the $_SESSION superglobal.

This allows you to keep track of things like login status, shopping cart contents, or user preferences as they navigate through your site.

Using Session Variables

Once a session has started, you can store and retrieve data using the $_SESSION array.

For example:

session_start();
$_SESSION['username'] = 'john_doe';

Then on another page:

session_start();
echo 'Welcome back, ' . $_SESSION['username'];

You can also update or remove session data:

• Update: $_SESSION['username'] = 'jane_doe';
• Remove one item: unset($_SESSION['username']);
• Remove all session data: $_SESSION = [];

Keep in mind that until you call session_start(), the $_SESSION array won’t be accessible.

Ending or Destroying a Session

Ending a session involves two steps: unsetting the session variables and destroying the session itself.

To completely log a user out or clear their session:

1. Start the session with session_start().
2. Unset all session variables with $_SESSION = [];.
3. Destroy the session with session_destroy();.

Also, if you want to make sure the session cookie is deleted:

if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

This ensures the browser forgets the session ID, so the user won’t be recognized next time unless they start a new session.

Common Issues and Tips

Sometimes sessions don’t behave as expected. Here are a few common pitfalls:

• Session not starting: Make sure session_start() is called before any output is sent to the browser — including whitespace or HTML.
• Lost session variables: Avoid using inconsistent domain names (like switching between www and non-www), as this may prevent the session cookie from being sent.
• Session timeout: By default, sessions expire after a period of inactivity (usually around 24 minutes). You can adjust this by changing settings in your php.ini file or managing expiration manually.

Also, never store sensitive data like passwords in session variables. While sessions are more secure than cookies, they still reside on the server and can be accessed if compromised.

That's how PHP sessions work in practice — nothing too complicated, but easy to mess up if you're not careful with the details.

The above is the detailed content of What is a PHP session?. For more information, please follow other related articles on the PHP Chinese website!