分享程序员开发的那些事...
更新时间：2023-01-22 12:02:27
在数小时的调试过程中，我发现在众多Google搜索中找到的参考文章以及大量的Stack Overflow答案(例如此处，此处和此处均提供无效或过时的信息.
I have found over the course of several hours debugging that the referenced articles found on numerous Google searches as well as a significant subset of Stack Overflow answers such as here, here and here all provide invalid or outdated information.
在将会话数据保存到数据库时可能导致[严重]问题的事情:
Things that can cause [critical] issues with saving session data to a database:
尽管所有示例在线状态都可以填充" session_set_save_handler，但是没有一个示例说明您也必须设置register_shutdown_function('session_write_close')(
While all the examples online state that you can "fill" the session_set_save_handler, none of them state that you must also set the register_shutdown_function('session_write_close') too (reference).
一些(较旧的)指南引用了过时的SQL数据库结构，因此应不使用.将会话数据保存到数据库所需的数据库结构为:id/access/data.而已.就像我在一些指南"和示例中看到的那样，不需要各种额外的时间戳列.
Several (older) guides refer to an outdated SQL Database structure, and should not be used. The database structure that you need for saving session data to the database is: id/access/data. That's it. no need for various extra timestamp columns as I've seen on a few "guides" and examples.
DELETE * FROM ... [在我的问题中提出的]类必须 实现 SessionHandlerInterface.我已经看到了指南(上面已引用)，这些指南给出了sessionHandler的实现，这是不合适的接口.也许以前版本的PHP的方法稍有不同(可能小于5.4).
The class [made in my question] must implement the SessionHandlerInterface . I have seen guides (referenced above) that give the implementation of sessionHandler which is not a suitable interface. Perhaps previous versions of PHP had a slightly different method (probably <5.4).
会话类方法必须返回PHP手册中列出的值.同样，可能是从5.4之前的PHP继承的，但是我阅读的两个指南指出class->open返回要读取的行，而
The session class methods must return the values set out by the PHP manual. Again, probably inherited from pre-5.4 PHP but two guides I read stated that class->open returns the row to be read, whereas the PHP manual states that it needs to return true or false only.
这是我的原始问题的原因:我使用的是自定义会话名称(实际上，会话名称和会话ID的相同是！)根据这篇非常好的***帖子，它生成的会话名称是长度为128个字符.由于会话名称是唯一的密钥，需要破解它才能破坏会话并接管会话劫持，那么更长的名称/ID是一件好事.
This is the cause of my Original Issue: I was using custom session names (actually id's as session names and session id's are the same thing!) as per this very good *** post and this was generating a session name that was 128 characters long. As the session name is the sole key that is needed to be cracked to compromise a session and take over with a session hijacking then a longer name/id is a very good thing.
因此，除了这些之外，还需要添加一些额外的细节:
So with all that out of the way there are some extra details to add as well:
PHP手册页(上面的链接)显示了一个类对象不合适的行:
The PHP manual page (linked above) shows an unsuitable pile of lines for a class object:
$handler = new MySessionHandler();
session_set_save_handler($handler, true);
session_start();
如果将其放在类构造函数中，效果也一样:
Whereas it works just as well if you put this in the class constructor:
class MySessionHandler implements SessionHandlerInterface {
private $database = null;
public function __construct(){
$this->database = new Database(whatever);
// Set handler to overide SESSION
session_set_save_handler(
array($this, "open"),
array($this, "close"),
array($this, "read"),
array($this, "write"),
array($this, "destroy"),
array($this, "gc")
);
register_shutdown_function('session_write_close');
session_start();
}
...
}
这意味着要在输出页面上开始会话，您需要做的是:
This means that to then start a session on your output page all you need is:
<?php
require "path/to/sessionhandler.class.php";
new MySessionHandler();
//Bang session has been setup and started and works
完整的Session通讯类如下，以供参考，该类适用于PHP 5.6(可能是7，但尚未在7上进行测试)
For reference the complete Session communication class is as follows, this works with PHP 5.6 (and probably 7 but not tested on 7 yet)
<?php
/***
* Created by PhpStorm.
***/
class MySessionHandler implements SessionHandlerInterface {
private $database = null;
public function __construct($sessionDBconnectionUrl){
/***
* Just setting up my own database connection. Use yours as you need.
***/
require_once "class.database.include.php";
$this->database = new DatabaseObject($sessionDBconnectionUrl);
// Set handler to overide SESSION
session_set_save_handler(
array($this, "open"),
array($this, "close"),
array($this, "read"),
array($this, "write"),
array($this, "destroy"),
array($this, "gc")
);
register_shutdown_function('session_write_close');
session_start();
}
/**
* Open
*/
public function open($savepath, $id){
// If successful
$this->database->getSelect("SELECT `data` FROM sessions WHERE id = ? LIMIT 1",$id,TRUE);
if($this->database->selectRowsFoundCounter() == 1){
// Return True
return true;
}
// Return False
return false;
}
/**
* Read
*/
public function read($id)
{
// Set query
$readRow = $this->database->getSelect('SELECT `data` FROM sessions WHERE id = ? LIMIT 1', $id,TRUE);
if ($this->database->selectRowsFoundCounter() > 0) {
return $readRow['data'];
} else {
return '';
}
}
/**
* Write
*/
public function write($id, $data)
{
// Create time stamp
$access = time();
// Set query
$dataReplace[0] = $id;
$dataReplace[1] = $access;
$dataReplace[2] = $data;
if ($this->database->noReturnQuery('REPLACE INTO sessions(id,access,`data`) VALUES (?, ?, ?)', $dataReplace)) {
return true;
} else {
return false;
}
}
/**
* Destroy
*/
public function destroy($id)
{
// Set query
if ($this->database->noReturnQuery('DELETE FROM sessions WHERE id = ? LIMIT 1', $id)) {
return true;
} else {
return false;
}
}
/**
* Close
*/
public function close(){
// Close the database connection
if($this->database->dbiLink->close){
// Return True
return true;
}
// Return False
return false;
}
/**
* Garbage Collection
*/
public function gc($max)
{
// Calculate what is to be deemed old
$old = time() - $max;
if ($this->database->noReturnQuery('DELETE FROM sessions WHERE access < ?', $old)) {
return true;
} else {
return false;
}
}
public function __destruct()
{
$this->close();
}
}
用法:如类代码文本上方所示.
Usage: As shown just above the class code text.