1
因此,我正在創建一個登錄系統,並且用戶應該在超過24分鐘內登錄。這就是爲什麼我決定將會話存儲在我的數據庫中。
我用這個功能:(我建立我自己的SQL的連接 - > sqlConnectionConfig.php)
sessions.php文件(我發現php.net此代碼。):在sql中存儲會話(session_set_save_handler())
class session {
// session-lifetime
var $lifeTime;
// mysql-handle
var $dbHandle;
function open($savePath, $sessName) {
// get session-lifetime
$this->lifeTime = get_cfg_var("session.gc_maxlifetime");
// open database-connection
require_once '../sqlConnectionConfig.php';
$dbHandle = @mysql_connect($sqlHost,$sqlUser,$sqlPass);
$dbSel = @mysql_select_db($sqlDb,$dbHandle);
//return success
if(!$dbHandle || !$dbSel)
return false;
$this->dbHandle = $dbHandle;
return true;
}
function close() {
$this->gc(ini_get('session.gc_maxlifetime'));
// close database-connection
return @mysql_close($this->dbHandle);
}
function read($sessID) {
// fetch session-data
$res = mysql_query("SELECT session_data AS d FROM ws_sessions
WHERE session_id = '$sessID'
AND session_expires > ".time(),$this->dbHandle);
// return data or an empty string at failure
if($row = mysql_fetch_assoc($res))
return $row['d'];
return "";
}
function write($sessID,$sessData) {
// new session-expire-time
$newExp = time() + $this->lifeTime;
// is a session with this id in the database?
$res = mysql_query("SELECT * FROM ws_sessions
WHERE session_id = '$sessID'",$this->dbHandle);
// if yes,
if(mysql_num_rows($res)) {
// ...update session-data
mysql_query("UPDATE ws_sessions
SET session_expires = '$newExp',
session_data = '$sessData'
WHERE session_id = '$sessID'",$this->dbHandle);
// if something happened, return true
if(mysql_affected_rows($this->dbHandle))
return true;
}
// if no session-data was found,
else {
// create a new row
mysql_query("INSERT INTO ws_sessions (
session_id,
session_expires,
session_data)
VALUES(
'$sessID',
'$newExp',
'$sessData')",$this->dbHandle);
// if row was created, return true
if(mysql_affected_rows($this->dbHandle))
return true;
}
// an unknown error occured
return false;
}
function destroy($sessID) {
// delete session-data
mysql_query("DELETE FROM ws_sessions WHERE session_id = '$sessID'",$this->dbHandle);
// if session was deleted, return true,
if(mysql_affected_rows($this->dbHandle))
return true;
// ...else return false
return false;
}
function gc($sessMaxLifeTime) {
// delete old sessions
mysql_query("DELETE FROM ws_sessions WHERE session_expires < ".time(),$this->dbHandle);
// return affected rows
return mysql_affected_rows($this->dbHandle);
}
}
我的兩個管理員/ index.php的和管理/ admin.php的文件具有相同的session_start():
ini_set("session.gc_maxlifetime", "18000");
require_once 'sessions.php';
$session = new session();
session_set_save_handler(array(&$session,"open"),
array(&$session,"close"),
array(&$session,"read"),
array(&$session,"write"),
array(&$session,"destroy"),
array(&$session,"gc"));
session_start();
在index.php包含表單,並經由柱發送登錄數據以admin.php的。
問題是:它會在24分鐘後註銷。但我不知道爲什麼,My db成功存儲會話。
這看起來像一個SQL注入漏洞,如果用戶操縱session_id你是pwnd,那麼在將它注入到SQL之前使用'$ var = mysql_real_escape_string($ var)'聲明。 – Johan