2011-09-01 53 views
1

因此,我正在創建一個登錄系統,並且用戶應該在超過24分鐘內登錄。這就是爲什麼我決定將會話存儲在我的數據庫中。
我用這個功能:(我建立我自己的SQL的連接 - > sqlConnectionConfig.php)
sessions.php文件(我發現php.net此代碼。):在sql中存儲會話(session_set_save_handler())

class session { 
    // session-lifetime 
    var $lifeTime; 
    // mysql-handle 
    var $dbHandle; 
    function open($savePath, $sessName) { 
     // get session-lifetime 
     $this->lifeTime = get_cfg_var("session.gc_maxlifetime"); 
     // open database-connection 
     require_once '../sqlConnectionConfig.php'; 
     $dbHandle = @mysql_connect($sqlHost,$sqlUser,$sqlPass); 
     $dbSel = @mysql_select_db($sqlDb,$dbHandle); 
     //return success 
     if(!$dbHandle || !$dbSel) 
      return false; 
     $this->dbHandle = $dbHandle; 
     return true; 
    } 
    function close() { 
     $this->gc(ini_get('session.gc_maxlifetime')); 
     // close database-connection 
     return @mysql_close($this->dbHandle); 
    } 
    function read($sessID) { 
     // fetch session-data 
     $res = mysql_query("SELECT session_data AS d FROM ws_sessions 
          WHERE session_id = '$sessID' 
          AND session_expires > ".time(),$this->dbHandle); 
     // return data or an empty string at failure 
     if($row = mysql_fetch_assoc($res)) 
      return $row['d']; 
     return ""; 
    } 
    function write($sessID,$sessData) { 
     // new session-expire-time 
     $newExp = time() + $this->lifeTime; 
     // is a session with this id in the database? 
     $res = mysql_query("SELECT * FROM ws_sessions 
          WHERE session_id = '$sessID'",$this->dbHandle); 
     // if yes, 
     if(mysql_num_rows($res)) { 
      // ...update session-data 
      mysql_query("UPDATE ws_sessions 
         SET session_expires = '$newExp', 
         session_data = '$sessData' 
         WHERE session_id = '$sessID'",$this->dbHandle); 
      // if something happened, return true 
      if(mysql_affected_rows($this->dbHandle)) 
       return true; 
     } 
     // if no session-data was found, 
     else { 
      // create a new row 
      mysql_query("INSERT INTO ws_sessions (
         session_id, 
         session_expires, 
         session_data) 
         VALUES(
         '$sessID', 
         '$newExp', 
         '$sessData')",$this->dbHandle); 
      // if row was created, return true 
      if(mysql_affected_rows($this->dbHandle)) 
       return true; 
     } 
     // an unknown error occured 
     return false; 
    } 
    function destroy($sessID) { 
     // delete session-data 
     mysql_query("DELETE FROM ws_sessions WHERE session_id = '$sessID'",$this->dbHandle); 
     // if session was deleted, return true, 
     if(mysql_affected_rows($this->dbHandle)) 
      return true; 
     // ...else return false 
     return false; 
    } 
    function gc($sessMaxLifeTime) { 
     // delete old sessions 
     mysql_query("DELETE FROM ws_sessions WHERE session_expires < ".time(),$this->dbHandle); 
     // return affected rows 
     return mysql_affected_rows($this->dbHandle); 
    } 
} 



我的兩個管理員/ index.php的和管理/ admin.php的文件具有相同的session_start():

ini_set("session.gc_maxlifetime", "18000"); 
    require_once 'sessions.php'; 
    $session = new session(); 
    session_set_save_handler(array(&$session,"open"), 
          array(&$session,"close"), 
          array(&$session,"read"), 
          array(&$session,"write"), 
          array(&$session,"destroy"), 
          array(&$session,"gc")); 
    session_start(); 

在index.php包含表單,並經由柱發送登錄數據以admin.php的。
問題是:它會在24分鐘後註銷。但我不知道爲什麼,My db成功存儲會話。

+1

這看起來像一個SQL注入漏洞,如果用戶操縱session_id你是pwnd,那麼在將它注入到SQL之前使用'$ var = mysql_real_escape_string($ var)'聲明。 – Johan

回答

0

我發現,即,此行引發的問題:

$this->lifeTime = get_cfg_var("session.gc_maxlifetime"); 

所以,我手動設置。 ($ this-> lifeTime = 18000;)