Resource Types
This extension has no resource types defined.
Predefined Constants
The constants below are defined by this extension, and will
only be available when the extension has either been compiled
into PHP or dynamically loaded at runtime.
SID (string)
Constant containing either the session name and session
ID in the form of "name=ID" or empty string if
session ID was set in an appropriate session cookie.
Examples
Note: As of PHP 4.1.0, $_SESSION is available as a global
variable just like $_POST, $_GET, $_REQUEST and so on. Unlike
$HTTP_SESSION_VARS, $_SESSION is always global. Therefore,
you do not need to use the global keyword for $_SESSION.
Please note that this documentation has been changed to
use $_SESSION everywhere. You can substitute $HTTP_SESSION_VARS
for $_SESSION, if you prefer the former. Also note that
you must start your session using session_start() before
use of $_SESSION becomes available.
The keys in the $_SESSION associative array are subject
to the same limitations as regular variable names in PHP,
i.e. they cannot start with a number and must start with
a letter or underscore. For more details see the section
on variables in this manual.
If register_globals is disabled, only members of the global
associative array $_SESSION can be registered as session
variables. The restored session variables will only be available
in the array $_SESSION.
Use of $_SESSION (or $HTTP_SESSION_VARS with PHP 4.0.6
or less) is recommended for improved security and code readability.
With $_SESSION, there is no need to use the session_register(),
session_unregister(), session_is_registered() functions.
Session variables are accessible like any other variables.
Example 1. Registering a variable with $_SESSION.
<?php
session_start();
// Use $HTTP_SESSION_VARS with PHP 4.0.6 or less
if (!isset($_SESSION['count'])) {
$_SESSION['count'] = 0;
} else {
$_SESSION['count']++;
}
?>
Example 2. Unregistering a variable with $_SESSION and register_globals
disabled.
<?php
session_start();
// Use $HTTP_SESSION_VARS with PHP 4.0.6 or less
unset($_SESSION['count']);
?>
Caution
Do NOT unset the whole $_SESSION with unset($_SESSION) as
this will disable the registering of session variables through
the $_SESSION superglobal.
Example 3. Unregistering a variable with register_globals
enabled, after registering it using $_SESSION.
<?php
session_start();
// With PHP 4.3 and later, you can also simply use the prior
example.
session_unregister('count');
?>
If register_globals is enabled, then each global variable
can be registered as session variable. Upon a restart of
a session, these variables will be restored to corresponding
global variables. Since PHP must know which global variables
are registered as session variables, users need to register
variables with session_register() function. You can avoid
this by simply setting entries in $_SESSION.
Caution
If you are using $_SESSION and disable register_globals,
do not use session_register(), session_is_registered() and
session_unregister(), if your scripts shall work in PHP
4.2 and earlier. You can use these functions in 4.3 and
later.
If you enable register_globals, session_unregister() should
be used since session variables are registered as global
variables when session data is deserialized. Disabling register_globals
is recommended for both security and performance reasons.
Example 4. Registering a variable with register_globals
enabled
<?php
if (! isset($_SESSION['count'])) {
$_SESSION['count'] = 1;
} else {
$_SESSION['count']++;
}
?>
If register_globals is enabled, then the global variables
and the $_SESSION entries will automatically reference the
same values which were registered in the prior session instance.
There is a defect in PHP 4.2.3 and earlier. If you register
a new session variable by using session_register(), the
entry in the global scope and the $_SESSION entry will not
reference the same value until the next session_start().
I.e. a modification to the newly registered global variable
will not be reflected by the $_SESSION entry. This has been
corrected in PHP 4.3.
Passing the Session ID
There are two methods to propagate a session id:
Cookies
URL parameter
The session module supports both methods. Cookies are optimal,
but because they are not always available, we also provide
an alternative way. The second method embeds the session
id directly into URLs.
PHP is capable of transforming links transparently. Unless
you are using PHP 4.2 or later, you need to enable it manually
when building PHP. Under Unix, pass --enable-trans-sid to
configure. If this build option and the run-time option
session.use_trans_sid are enabled, relative URIs will be
changed to contain the session id automatically.
Note: The arg_separator.output php.ini directive allows
to customize the argument seperator. For full XHTML conformance,
specify & there.
Alternatively, you can use the constant SID which is always
defined. If the client did not send an appropriate session
cookie, it has the form session_name=session_id. Otherwise,
it expands to an empty string. Thus, you can embed it unconditionally
into URLs.
The following example demonstrates how to register a variable,
and how to link correctly to another page using SID.
