DB_eSession is a feature packed PHP class that stores session data in a MySQL database rather than files (PHP's default). It is powerful, designed with security in mind, and yet easy to utilize. The code contains lots of comments, it comes with full documentation, and examples of how to use the class including a basic authentication login/logout process. It includes member functions useful (to webmasters) for monitoring or viewing, deleting, and altering sessions validity like in the case of locking one or more sessions upon detection of unauthorized use. This custom MySQL database session handler class might just be what you're looking to implement on your web or intranet site. See the list of features below:
General features:
Stores session data in a MySQL table using PHP's built-in session handler.
Built-in handling of session expiration and cleanup.
Supports the changes of session related configuration settings (inc. PHP5).
Allows for normal or persistent MySQL database connections.
Access to opened MySQL resource connection to use in your script.
Accepts a passed database resource link to use as the DB connection.
Supports session ID's between 12 and 32 characters long.
Custom or changeable database, table and column names.
An option to create new session ID's (you supply, class or PHP builds).
Can initiate buffered output (using ob_start) within the class.
A session_start() automatically initiated within the class.
Can send 'Cache-Control:' header output within the class (fixes IE6 bug).
Ability to retrieve a specific sessions expiration date and time.
Retrieve current session life setting in seconds or minutes.
Retrieve a numeric total of the number of active and inactive sessions in table.
Facility to make assignment and retrieval of session variables easier.
Ability to create manual URI's and links that includes session name and ID.
The ability to retrieve what the MySQL server version number is.
An adequate form of encryption/decryption methods/functions are included and used automatically when libmcrypt is not installed.
Security features:
Standard user inactivity time-out handled automatically.
Absolute user logoff time-out capability (session will be terminated no matter what after a number of designated minutes/seconds have elapsed).
Ability to lock and unlock a particular session or all sessions. When a session is locked, it is immediately not available for use.
User to session verification using IP address and browser information.
Security level (code) clearance for each session/web page.
Encrypt/decrypt as desired each session field.
Encrypt/decrypt an extra session field to compare against original (to detect against possible tampering).
Encrypt/decrypt the whole session data in the table (essentially obscuring session variable names in table). Can be used in combination with per session field encryption, resulting in double encryption security.
A new encryption Initialization Vector is created every time values change.
Ability to manually delete a particular session or all sessions.
The users IP address and web browser is recorded as part of the session for tracing information.
Other features:
Support for multiple language error and warning messages.
Support of a default language as well as current active language settings.
Basic or detailed (with SQL syntax) error/warning reporting.
Buffered error and warning messages.
Option for class to stop execution or not upon encountering an error/warning. Class can display errors/warnings automatically or control in your script.
Can select font color and size separately for error and warning messages.
Code has lots of comments and formatted within 82 characters wide.
Full documentation (only provided in English) is included.
Code use examples provided, including a basic authentication (login/logout) process.
SQL text file provided for creating the MySQL session table.
By : toplay
Ver 1.0.2 - Download the zip file to see the class and other supporting files.
This is a short introduction to the feature packed DB_eSession PHP class, which allows the storage and management of session data in a MySQL database rather than files (which is PHP's default). It is powerful, designed with security in mind, and easy to utilize. It's free under the GNU GPL.
Files included in this package:
class.DB_eSession.php - Main class file.
errors.DB_eSession.php - Error and warning definitions used by class.
config.DB_eSession.php - Optional configuration file used to pass parameters to class.
eSessions_table.sql - A text file containing the SQL to create the MySQL sessions table.
index.php - An example home page of an authentication process.
login.php - An example page used to login members.
emplogin.php - An example page used to login employees.
logout.php - An example page of logging out members.
members.php - An example page of members restricted area.
employees.php - An example page of employees restricted area.
guess.php - A number guessing game showing an example of the use of the class.
examples.php - View code to get an idea of how to invoke various member functions of the class.
monitor.php - Session table monitoring and maintenance page (helpful while testing your scripts).
manual.html - DB_eSession class manual in HTML.
license.html - The GPL in HTML.
readme.html - This brief instructions file.
Basic installation steps (for more details refer to the 'How to install' section of the manual):
Use phpMyAdmin or similar tool to create a MySQL database, username and password. If you already have these defined/setup then you can use those if you wish and can skip this step.
Use the SQL within the eSessions_table.sql file to create the sessions table (using phpMyAdmin).
Update config.DB_eSessions.php with the name of the local host, database, username, password, table name, and column names if they are different than the supplied defaults.
Install the class.DB_eSession.php, errors.DB_eSession.php, and config.DB_eSession.php in a folder on your web server (and make sure the files and folder have the correct permissions). Optionally, you can install the examples.php, guess.php, monitor.php, and the six login/logout example files to test the class with. Otherwise, you can just start writing your own script utilizing the new class.
Open up your web browser and type the URL to point to the example PHP file you wish to run. i.e. www.example.com/guess.php or www.example.com/auth/index.php (this is assuming that you created a directory called 'auth' and placed the six login/logut example files and the class related files in it).
The monitor.php file allows you to view every row in the sessions table, lock/unlock, and delete sessions. It is intended as an aid while developing your scripts. Although it is useful for web masters to monitor session traffic, it is not recommend to place in a public directory (in a production ready site). If you still intend to use it in a public directory, then protect the page (like with a username and password) from easy access. If you're using an Apache server, you can protect the page by setting a .htaccess file. Also, read the Apache authentication information page.
Don't forget to read the DB_eSession class manual.
Click to
Download File| DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware. |
More User Management Code Articles
More By Codewalkers
 developerWorks - FREE Tools!
|
This whitepaper presents the benefits of successfully introducing static analysis into your organization using IBM Rational Software Analyzer. Additionally, it identifies some common pitfalls that can hinder the effective use of static analysis tooling as well as presents 10 simple strategies designed to help you quickly realize the value of static analysis using Rational Software Analyzer.
FREE! Go There Now!
|
|
|
|
CakePHP is a stable production-ready, rapid-development aid for building Web sites in PHP. This "Cook up Web sites fast with CakePHP" series shows you how to build an online product catalog using CakePHP.
FREE! Go There Now!
|
|
|
|
Visit IBM developerWorks to download a free trial version of Lotus Quickr 8.0, which enables collaboration by transforming the way everyday business content such as documents, rich media, photos, and video can be shared. Lotus Quickr makes it faster and easier to share content of all types (not just documents) within virtual teams. It is designed to make it easier to collaborate across organizational boundaries, while continuing to work within the context of familiar desktop applications.
FREE! Go There Now!
|
|
|
|
Visit IBM developerWorks to download a free trial version of IBM Rational Business Developer V7.1. Rational Business Developer offers rapid and simplified development of business applications and services through Enterprise Generation Language (EGL) tools, generating Java or mainframe solutions while shielding developers from technical complexities.
FREE! Go There Now!
|
|
|
|
Asset Reuse is a key strategy for companies looking to create innovative solutions to solve complex software development problems. Searching for, identifying, updating, using and deploying software assets can be a difficult challenge. Listen to this webcast, to learn about strategies and tools that you can leverage for a successful project, including Rational Asset Manager, Rational Software Architect and WebSphere Service Registry and Repository.
FREE! Go There Now!
|
|
|
|
Get a free trial download of the latest version of IBM Rational Performance Tester V7.0.1, a load and performance testing solution for teams concerned about the scalability of their Web-based applications. Combining multiple ease-of-use features with granular detail, Rational Performance Tester simplifies the test-creation, load-generation and data-collection processes that help teams ensure the ability of their applications to accommodate required user loads.
FREE! Go There Now!
|
|
|
|
Attend this launch webcast with Scott Hebner, Vice President of IBM Rational Marketing and Strategy, where he will overview Rational’s new offerings and programs to help customers accelerate software innovation on System z. He will discuss how these solutions help organizations extend their core business processes toward modern architectures such as SOA and web technologies to deliver business improvements that stand the test of time.
FREE! Go There Now!
|
|
|
|
Join the IBM Watchfire team for an informative discussion on techniques and best practices to proactively manage Web application security and how to effectively build application security testing into the software development lifecycle (SDLC). In this Software Delivery Platform webcast you will learn: How to better understand potential web application security vulnerabilities, best practices and how to effectively integrate application security testing into the software development lifecycle, the importance of detecting and removing software vulnerabilities during application development.
FREE! Go There Now!
|
|
|
|
User communities play an important role in communication and collaboration around products, solutions and other areas of special interest to members. Successful communities are able to provide the right mix of content and services to deliver a value proposition that resonates with each audience. Join Tom Inman, VP of Marketing for Information and Platform Solutions as he introduces the new LeverageINFORMATION community. During this webcast, learn about the value provided by the community and how customers and partners derive value from the community in addressing their own technical and business challenges.
FREE! Go There Now!
|
|
|
|
IBM Lotus Notes 8 provides a wide range of developers the ability to provide customized, integrated user interfaces via composite applications and via custom sidebar and toolbar plug-ins. This webcast provides you with tips and techniques to use with out-of-the-box capabilities of Lotus Notes 8, and survey how you can share useful components within your own company and within a larger community.
FREE! Go There Now!
|
|
|
|
All FREE IBM® developerWorks Tools!
|
