Question

I am making a session system for my website using PHP and MySQL. The idea is that a user session will last for around 5 minutes if they are inactive, and a CronJob runs every now and then and checks to see if sessions are expired, and if they are, removes the session.

The issue:

Every time someone loads their page it has to check the database to see if their session is still valid. I am wondering if in that CronJob task, I could make it find that users PHP Session and change a variable like $_SESSION['isValidSession'] and set it to false.

So once they load the page it just checks if that variable if the session is valid.

Sorry for the wall of text!

TL;DR: I want to modify session variables of different specified sessions.

Thanks.

Answer 1

Every time someone loads their page it has to check the database to
see if their session is still valid. I am wondering if in that CronJob
task, I could make it find that users PHP Session and change a
variable like $_SESSION[‘isValidSession’] and set it to false.

You have to do this regardless. When the users load their page, the system must verify whether the session exists in the database (I assume that you’re using a DB).

If you run the cron job every minute, and expire all sessions older than five (which seems rather excessive? I often stay inactive on a site for five, ten, even fifteen minutes if I am reading a long page), this will automatically “mark invalid” (actually remove) the sessions.

Normally you would keep a TIMESTAMP column with the time of last update of that row (meaning that session), and the cron job would DELETE all rows with timestamp older than five minutes ago. When reloading the page, the system would no longer find the relevant session row, and deduce (correctly) that the session has expired.

However, what you want (reading a session knowing its SessionID) can be accomplished by reading in the session by the cron job (you can code the job in PHP) either loading as extant session given its ID, or by reading the DB column holding the serialized data with a SELECT SessionData FROM SessionTable WHERE id = 'SessionId'; and de-serializing it. Then you modify the inflated object, re-serialize it and store it back in the database with SQL UPDATE. Hey presto!, session has now been modified.

But be aware that this will likely cause concurrency problems with active clients, and cannot be done in SQL in one fell swoop – you can’t execute UPDATE Sessions SET isInactive = 1 WHERE expiry... directly. Normally you need to read the rows of interest one by one, unserialize them and store them back, processing them with PHP code.

You can do it indirectly with two different workarounds.

One, you change your session code to use unserialized data. This will impact maintainability and performance (you can’t “just add” something to a session: you have to create a column for it).

Two: you take advantage of the fact that in serialized form, “0” and “1” have the same length. That is, the serialized session containing isValidSession (name of 14 characters) will contain the text

 ...{s:14:"isValidSession";b:1;}...

and you can change that piece of string with {s:14:"isValidSession";b:0;}, thus making isValidSession become False. This is not particularly good practice – you’re messing with the system’s internals. Of course, I don’t think anybody expects PHP’s serialized data syntax to change anytime soon (…or do they?).