Question

I have an odd issue. The first time a visitor comes to the site and I set anything is the session, it doesn’t stick. The second and all the following times I try to set something it sticks. After the initial try I can destroy the session and set something and it sticks. Its just the initial attempt to save something fails. I’m trying to save something to the session with $_SESSION['uid'] = $row["Id"];. I know the $row["Id"] is valid and holds data (I echoed it).

I am not using standard sessions. I am saving the session into a database. My session class is below. Is there anything I’m missing or doing wrong to explain this behavior?

Update:

Well I tested the session class on its own and it seems to be working :-/ But when I use it in my larger application _write never gets called, though __destruct does get called. Any idea why that may be?

<?php

include_once('db.php');

class PDOSession
{
    protected $pdo;
    protected $table = 'SessionData';

    public function __construct()
    {
        // Get a database connection
        $db = new PDOConnectionFactory();
        $this->pdo = $db->getConnection(true);

        // Start session
        session_set_save_handler(array($this, '_open'),
                                 array($this, '_close'),
                                 array($this, '_read'),
                                 array($this, '_write'),
                                 array($this, '_destroy'),
                                 array($this, '_gc'));
        session_start();
    }

    public function __destruct()
    {
        session_write_close();
    }

    protected function fetchSession($id)
    {
        $stmt = $this->pdo->prepare('SELECT id, data FROM '.$this->table.' WHERE id = :id AND unixtime > :unixtime');
        $stmt->execute(array(':id' => $id, ':unixtime' => (time() - (int)ini_get('session.gc_maxlifetime'))));
        $sessions = $stmt->fetchAll();

        return empty($sessions) ? false : $sessions[0];
    }

    public function _open($savePath, $sessionName)
    {
        return true;
    }

    public function _close()
    {
        return true;
    }

    public function _read($id)
    {
        $session = $this->fetchSession($id);
        return ($session === false) ? false : $session['data'];
    }

    public function _write($id, $sessionData)
    {
        $session = $this->fetchSession($id);
        if($session === false) {
            $stmt = $this->pdo->prepare('INSERT INTO '.$this->table.' (id, data, unixtime) VALUES (:id, :data, :time)');
        } else {
            $stmt = $this->pdo->prepare('UPDATE '.$this->table.' SET data = :data, unixtime = :time WHERE id = :id');
        }
        $stmt->execute(array(
                        ':id' => $id,
                        ':data' => $sessionData,
                        ':time' => time()
                        ));
    }

    public function _destroy($id)
    {
        $stmt = $this->pdo->prepare('DELETE FROM '.$this->table.' WHERE id = :id');
        $stmt->execute(array(':id' => $id));
    }

    public function _gc($maxlifetime)
    {
        $stmt = $this->pdo->prepare('DELETE FROM '.$this->table.' WHERE unixtime < :time');
        $stmt->execute(array(':time' => (time() - (int) $maxlifetime)));
    }
}
$newPDOSessionStartHere = new PDOSession();

Answer 1

I’m a bit of an idiot I guess. I was calling session_destroy() rather than session_unset() to clear things out at the top of my authentication script. The class works fine.