Question

I have a page which contains $_SESSION variables. Now after a certain amount of time, all the sessions will expire which is fair enough. But the problem is that suddenly we get undefined notices on our $_SESSION variables as they are now expired.

So in this situation what is the best thing to do when a session expires. DO we just include a the E ^ NOTICE code in order to not show notices (afterwe know the page is fully complete with no errors), or are we expected to destroy a session using session_destroy() on the page, or is there other ways of not showing these undefined errors to the users who are viewing these pages on the browser and may view the page when the session has expired.

Below is my example code I have on how I have $_SESSION code displayed:

 <?php

    ini_set('session.gc_maxlifetime',12*60*60); //12 hours until session expires
    ini_set('session.gc_divisor', '1');
    ini_set('session.gc_probability', '1');
    ini_set('session.cookie_lifetime', '0');
    require_once 'init.php'; 

    session_start();  //starts sessions

    include('member.php');  //this php script also contains sessions


    if (isset($_POST['id'])) {

    $_SESSION['id'] = $_POST['id'];

    }


    if(isset($_POST['sessionNum'])){
                //Declare my counter for the first time

                $_SESSION['initial_count'] = $_POST['sessionNum'];
                $_SESSION['sessionNum'] = intval($_POST['sessionNum']);
                $_SESSION['sessionCount'] = 1;

        }

    if (isset($_POST['submitDetails']) && $_SESSION['sessionCount'] < $_SESSION['sessionNum']) {
        $_SESSION['sessionCount']++;
    }


    $sessionMinus =  $_SESSION['sessionCount'];


    if (isset($_POST['textQuestion'])) {

    $_SESSION['textQuestion'] = $_POST['textQuestion'];

    }

    if (isset($_POST['textMarks'])) {

    $_SESSION['textMarks'] = $_POST['textMarks'];

    }

    if (isset($_POST['totalWeight'])) {

    $_SESSION['totalWeight'] = $_POST['totalWeight'];

    }

    if ($sessionMinus == $_SESSION['initial_count']){ 

        $action = 'individualmarks.php'; 

    }elseif($sessionMinus != $_SESSION['initial_count']){ 

        $action = $_SERVER['PHP_SELF']; 

    }

    ?>

Answer 1

Check for the presence of a particular sentinel value. e.g. if whatever you’re doing with the session is for a login-protected system, then check the value of
isset($_SESSION['loggedIn']) && ($_SESSION['loggedIn'] == true).

If the sentinel value(s) are not present, then something’s happened to the session, and you should redirect the user elsewhere to restore things to the way they should be (e.g. show the login page).

Since you can’t know in advance what page a “slow” user will hit, you have to assume the session can vanish at any time, and do the sentinel checks on EVERY page.