DB_eSession is a feature packed PHP class that stores session data in a MySQL database rather than files (PHP's default). It is powerful, designed with security in mind, and yet easy to utilize. The code contains lots of comments, it comes with full documentation, and examples of how to use the class including a basic authentication login/logout process. It includes member functions useful (to webmasters) for monitoring or viewing, deleting, and altering sessions validity like in the case of locking one or more sessions upon detection of unauthorized use. This custom MySQL database session handler class might just be what you're looking to implement on your web or intranet site. See the list of features below:
General features:
Stores session data in a MySQL table using PHP's built-in session handler.
Built-in handling of session expiration and cleanup.
Supports the changes of session related configuration settings (inc. PHP5).
Allows for normal or persistent MySQL database connections.
Access to opened MySQL resource connection to use in your script.
Accepts a passed database resource link to use as the DB connection.
Supports session ID's between 12 and 32 characters long.
Custom or changeable database, table and column names.
An option to create new session ID's (you supply, class or PHP builds).
Can initiate buffered output (using ob_start) within the class.
A session_start() automatically initiated within the class.
Can send 'Cache-Control:' header output within the class (fixes IE6 bug).
Ability to retrieve a specific sessions expiration date and time.
Retrieve current session life setting in seconds or minutes.
Retrieve a numeric total of the number of active and inactive sessions in table.
Facility to make assignment and retrieval of session variables easier.
Ability to create manual URI's and links that includes session name and ID.
The ability to retrieve what the MySQL server version number is.
An adequate form of encryption/decryption methods/functions are included and used automatically when libmcrypt is not installed.
Security features:
Standard user inactivity time-out handled automatically.
Absolute user logoff time-out capability (session will be terminated no matter what after a number of designated minutes/seconds have elapsed).
Ability to lock and unlock a particular session or all sessions. When a session is locked, it is immediately not available for use.
User to session verification using IP address and browser information.
Security level (code) clearance for each session/web page.
Encrypt/decrypt as desired each session field.
Encrypt/decrypt an extra session field to compare against original (to detect against possible tampering).
Encrypt/decrypt the whole session data in the table (essentially obscuring session variable names in table). Can be used in combination with per session field encryption, resulting in double encryption security.
A new encryption Initialization Vector is created every time values change.
Ability to manually delete a particular session or all sessions.
The users IP address and web browser is recorded as part of the session for tracing information.
Other features:
Support for multiple language error and warning messages.
Support of a default language as well as current active language settings.
Basic or detailed (with SQL syntax) error/warning reporting.
Buffered error and warning messages.
Option for class to stop execution or not upon encountering an error/warning. Class can display errors/warnings automatically or control in your script.
Can select font color and size separately for error and warning messages.
Code has lots of comments and formatted within 82 characters wide.
Full documentation (only provided in English) is included.
Code use examples provided, including a basic authentication (login/logout) process.
SQL text file provided for creating the MySQL session table.
By : toplay
Ver 1.0.2 - Download the zip file to see the class and other supporting files.
This is a short introduction to the feature packed DB_eSession PHP class, which allows the storage and management of session data in a MySQL database rather than files (which is PHP's default). It is powerful, designed with security in mind, and easy to utilize. It's free under the GNU GPL.
Files included in this package:
class.DB_eSession.php - Main class file.
errors.DB_eSession.php - Error and warning definitions used by class.
config.DB_eSession.php - Optional configuration file used to pass parameters to class.
eSessions_table.sql - A text file containing the SQL to create the MySQL sessions table.
index.php - An example home page of an authentication process.
login.php - An example page used to login members.
emplogin.php - An example page used to login employees.
logout.php - An example page of logging out members.
members.php - An example page of members restricted area.
employees.php - An example page of employees restricted area.
guess.php - A number guessing game showing an example of the use of the class.
examples.php - View code to get an idea of how to invoke various member functions of the class.
monitor.php - Session table monitoring and maintenance page (helpful while testing your scripts).
manual.html - DB_eSession class manual in HTML.
license.html - The GPL in HTML.
readme.html - This brief instructions file.
Basic installation steps (for more details refer to the 'How to install' section of the manual):
Use phpMyAdmin or similar tool to create a MySQL database, username and password. If you already have these defined/setup then you can use those if you wish and can skip this step.
Use the SQL within the eSessions_table.sql file to create the sessions table (using phpMyAdmin).
Update config.DB_eSessions.php with the name of the local host, database, username, password, table name, and column names if they are different than the supplied defaults.
Install the class.DB_eSession.php, errors.DB_eSession.php, and config.DB_eSession.php in a folder on your web server (and make sure the files and folder have the correct permissions). Optionally, you can install the examples.php, guess.php, monitor.php, and the six login/logout example files to test the class with. Otherwise, you can just start writing your own script utilizing the new class.
Open up your web browser and type the URL to point to the example PHP file you wish to run. i.e. www.example.com/guess.php or www.example.com/auth/index.php (this is assuming that you created a directory called 'auth' and placed the six login/logut example files and the class related files in it).
The monitor.php file allows you to view every row in the sessions table, lock/unlock, and delete sessions. It is intended as an aid while developing your scripts. Although it is useful for web masters to monitor session traffic, it is not recommend to place in a public directory (in a production ready site). If you still intend to use it in a public directory, then protect the page (like with a username and password) from easy access. If you're using an Apache server, you can protect the page by setting a .htaccess file. Also, read the Apache authentication information page.
Don't forget to read the DB_eSession class manual.
Click to
Download File| DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware. |
More User Management Code Articles
More By Codewalkers
 developerWorks - FREE Tools!
|
Attend this launch webcast with Scott Hebner, Vice President of IBM Rational Marketing and Strategy, for an overview of Rational’s new software offerings and resources to help modernize and accelerate software innovation on i on Power Systems – while ensuring past application investments are protected and continue to grow. Learn how these solutions are helping customers extend their core i5/OS solutions toward modern architectures such as SOA and web technologies to deliver business improvements that stand the test of time.
FREE! Go There Now!
|
|
|
|
You probably have thousands of lines of COBOL code loaded with business intelligence and being used to run your business, along with an army of developers maintaining these applications. Learn how to prepare your applications and developers so you can keep that competitive edge and move to a service-oriented architecture with the IBM Rational Enterprise Modernization solutions. Replay is available for 9 months.
FREE! Go There Now!
|
|
|
|
Poor Requirements Management capabilities in an Enterprise have been linked to excessive project failures, escalating IT costs, and failure to deliver competitive advantage into the marketplace. Join Brianna M Smith from IBM Rational and learn about how successful organizations align IT and Business stakeholders through collaborative processes and tools for effective requirements management, and how an integrated approach across the IT lifecycle can provide unparalleled visibility and traceability to ensure that project teams are delivering on the business vision by "doing the right things" and "doing things right."
FREE! Go There Now!
|
|
|
|
Manage, govern, and share services across your organization by using WebSphere Service Registry and Repository. Follow the hands-on exercises to learn how to navigate the Web interface to publish, find, reuse, and update services.
FREE! Go There Now!
|
|
|
|
Get a free trial download of IBM Lotus Forms V3.0 (formerly Workplace Forms), which provides a zero-footprint eForms solution to help you automate and move forms-based business processes off the desktop and onto the Web. With Lotus Forms, you can extend applications beyond the firewall by creating a single electronic form document ready for use in both thick and Web 2.0 thin client format.
FREE! Go There Now!
|
|
|
|
Try the latest version of IBM Rational Manual Tester V7.0.1 by downloading a free trial from IBM developerWorks. This manual test authoring and execution tool promotes test step reuse to reduce the impact of software change on testers and business analysts and addresses the needs of teams performing at least a portion of their testing manually.
FREE! Go There Now!
|
|
|
|
Get a free trial download of the latest version of IBM Rational Performance Tester V7.0.1, a load and performance testing solution for teams concerned about the scalability of their Web-based applications. Combining multiple ease-of-use features with granular detail, Rational Performance Tester simplifies the test-creation, load-generation and data-collection processes that help teams ensure the ability of their applications to accommodate required user loads.
FREE! Go There Now!
|
|
|
|
Visit IBM developerWorks to try the IBM SOA Sandbox for people. The SOA Sandbox for people provides a trial environment with the necessary tooling and components required to enable consistent human and process interaction and collaboration, showing how you can improve user experience and business productivity.
FREE! Go There Now!
|
|
|
|
Join this Rational Talks to You teleconference, to hear how Enterprise Generation Language (EGL) eliminates the need for tedious and error-prone low level coding, so developers can focus on business requirements. EGL extends the Rational software development platform with a simplified programming language that enables developers who have little or no experience with Java, Web technologies or Service Oriented Architecture, to create enterprise-class applications and services quickly and easily. It also allows developers who may have little or no mainframe programming experience to quickly create traditional mainframe components.
FREE! Go There Now!
|
|
|
|
In this webcast, IBM Rational will discuss the importance of Web application security and will share techniques and best practices to introduce application security testing into current QA processes including: understanding common security vulnerabilities and techniques to integrate security testing with defect tracking and remediation systems in an effort to safeguard sensitive online information.
FREE! Go There Now!
|
|
|
|
All FREE IBM® developerWorks Tools!
|
