Question

What I want to do is write a custom PHP session class that stores sessions in the database without using session_set_save_handler().

The purpose of this is so I can easily store data using serialize() and return it using unserialize().

I’ve been looking all day, can’t find anything on this subject. Can anyone help get me started or link me to a useful tutorial?

Thanks.

Answer 1

You do not need the build-in PHP session for that, you can set the cookie yourself, read it and validate it again, from that point on you got a fully functioning session!

function createCookieString($id, $user, $created)
{
    $cookieData = array();
    $hash = $this->hashSession($id, $user, $created);

    $cookieData[] = $id;
    $cookieData[] = $user;
    $cookieData[] = $created;
    $cookieData[] = $hash;

    return implode(':', $cookieData);
}

function hashSession($id, $user, $created)
{
    $cookieSalt = 'Your Cookie Salt'; //google what a salt is in hashing if neccecary
    return md5($id.$user.$created.$cookieSalt);
}

function parseCookieString($string)
{
    return explode(':', $string);

}

To set the cookie, just use the setcookie function of php.

You just have to store the session in your database. Its usually verry simple, just a table with ID, userID, created (beeing the timestamp), you dont need the hash to be in your db because its a reusable secret.

feel free to ask any more questions!