PHP Session Management

Session management is about keeping that visitor ticket safe from thieves. You swap the ticket for a fresh one at important moments and close it properly when the visitor leaves.

In this page:

Session Security Checks
Setting Session Timeout Limits
Custom Session Configuration
Session Status and States
Session Name and ID

Syntax

php

session_start();
session_regenerate_id(true);                 // new ID after login

session_set_cookie_params(lifetime, path, domain, secure, httponly);   // before session_start()
$_SESSION["last_activity"] = time();

Session Security Checks

Session hijacking happens when an attacker steals a valid session ID and impersonates the user; regenerating the session ID with session_regenerate_id() right after login invalidates any ID an attacker may already have captured.

Example: Session Security Checks

php

<?php
// Call `session_start()`
session_start();
// Call `session_regenerate_id(true)`
session_regenerate_id(true);
// Print "Session ID regenerated after login" to the output
echo "Session ID regenerated after login";
?>

Setting Session Timeout Limits

A simple timeout pattern stores a last-activity timestamp in $_SESSION and checks it on every page load, forcing a logout if too much time has passed -- protecting accounts left open on shared or public computers.

Example: Setting Session Timeout Limits

php

<?php
// Call `session_start()`
session_start();
// Declare `$timeout`, set to `1800`
$timeout = 1800;
// Set `$_SESSION['last_activity']` to `time() - 2000`
$_SESSION['last_activity'] = time() - 2000;
// Check whether `time() - $_SESSION['last_activity'] > $timeout`
if (time() - $_SESSION['last_activity'] > $timeout) {
    // Print "Session expired -- logging out" to the output
    echo "Session expired -- logging out";
// Otherwise, run this branch
} else {
    // Set `$_SESSION['last_activity']` to `time()`
    $_SESSION['last_activity'] = time();
}
?>

Custom Session Configuration

Before calling session_start(), you can configure cookie lifetime, path, and security flags with session_set_cookie_params(), giving you control over how long a session cookie survives and where it's valid.

Example: Custom Session Configuration

php

<?php
// Call `session_set_cookie_params(3600, '/', '', true, true)`
session_set_cookie_params(3600, '/', '', true, true);
// Call `session_start()`
session_start();
// Print "Session cookie configured before starting" to the output
echo "Session cookie configured before starting";
?>

Session Status and States

session_status() tells you whether sessions are disabled, inactive, or already active, which is useful for guarding against calling session_start() twice or checking session state before performing sensitive actions.

Example: Session Status and States

php

<?php
// Print `session_status() === PHP_SESSION_NONE ? "No session yet\n" : "Session active\n"` to the output
echo session_status() === PHP_SESSION_NONE ? "No session yet\n" : "Session active\n";
// Call `session_start()`
session_start();
// Print `session_status() === PHP_SESSION_ACTIVE ? "Now active" : "Still inactive"` to the output
echo session_status() === PHP_SESSION_ACTIVE ? "Now active" : "Still inactive";
?>

Session Name and ID

session_name() and session_id() let you inspect or override the identifiers PHP uses under the hood, which matters when running multiple independent apps on the same domain that shouldn't share session data.

Example: Session Name and ID

php

<?php
// Call `session_start()`
session_start();
// Print `session_name() . ": " . session_id()` to the output
echo session_name() . ": " . session_id();
?>

Chapter Quiz — Complete all 5 topics to unlock

0/5 topics done

Complete these topics first:

← Previous Lesson PHP Sessions Introduction Next Lesson → PHP Cookies Introduction