Question

I’m working with some existing PHP/MySQL code. I’m logging/tracking certain activities into a MySQL database. Certain access points are being logged. The number of times a user logs-into the system is counted. But, I need to also log the amount of time a user is logged-in, as well as the time the user is in a certain section of the Web site.

Since PHP is a stateless environment, for the most part, what’s the best way to record the end-point(s); or when the user logs-out?

Note: I can’t force the user to log out, as the browser can just be closed. Maybe I could just put up an AJAX timer that would count the minutes? If so, should I treat activities and time logged-in as different tables of information (MySQL)?

Edit: I forgot to mention we do have jQuery available.

Answer 1

Like you said, you can’t force the user to logout, and you can’t know for sure whether he’s looking at your page or playing Pinball.

A solution would be an AJAX request every, say 5 minutes, to tell your application that the user is active. Unfortunately, if your user has locked his screen and went to play Pinball, you still don’t know exactly what he is doing. Also, doing AJAX requests at intervals like this will increase server load, especially in a multi-user environment.

The best solution I think is to simply store the start_time of the user (when he logs in), then to update the end_time at every action he does, and with a session timeout.

Per example:

• I log in at 5:00. Update the start_time to 5:00.
• I browse to foo.php at 5:01. Update the end_time to 5:01.
• I browse to bar.php at 5:03. Update the end_time to 5:03.
• I go for a coffee at 5:05.
• I come back at 5:15 and my session expired, I need to relogin.

So, you know I spent roughly 3 minutes on your application, since the last action I did was at 5:03 (5:03 - 5:00 = 3). Of course, you can’t know exactly if it was 3 or 5 minutes. But you can assume, most of the times anyway, that if I don’t do anything on your application (i.e.: execute a script, call, etc.), that I’m not using it.

Obviously, if you can capture JavaScript events like window close it’s even better, or if I sign out manually: you update the end_time accordingly.