Home > Article > Backend Development > Analysis of the working principle of php session_PHP tutorial
Analysis of the working principle of php session_PHP tutorial
- WBOYOriginal
- 2016-07-13 16:56:33796browse
Session is a server global variable. Why can it switch between different pages without losing data and not saving the data on the client? Let’s take a look at the working principle and usage of session.
As we all know, the http protocol is a stateless protocol. Simply put, the web server does not know who is the person connected now. In order to meet the need for selectively sending information, a lot has been done on the basis of http. Extensions to achieve this purpose, such as digital signatures, cookies, sessions, etc.
How can a web server or web program know who is connected now? To solve this problem, we first need to establish a one-to-one correspondence between the server and the client. Below I will explain how this correspondence is established by grabbing the content of http.
I use an http packet sniffing tool called httplook, and then create a file called test.php in the root directory of the local web server. The address is: http://localhost/test.php. After everything is ready, I pass The browser opens this page repeatedly.
| The code is as follows | Copy code |
| 代码如下 | 复制代码 |
|
session_start(); if (isset($_SESSION['test_sess'])){ $_SESSION['test_sess']++; }else{ $_SESSION['test_sess'] = 0; } echo $_SESSION['test_sess']; ?>; |
|
if (isset($_SESSION['test_sess'])){
$_SESSION['test_sess']++;
| 代码如下 | 复制代码 |
| GET /test.php HTTP/1.1 Accept: */* Referer: http://localhost/ Accept-Language: zh-cn Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322) Host: localhost Connection: Keep-Alive |
|
}
echo $_SESSION['test_sess'];
| 代码如下 | 复制代码 |
| HTTP/1.1 200 OK Date: Fri, 26 Aug 2005 07:44:22 GMT Server: Apache/2.0.54 (Win32) SVN/1.2.1 PHP/5.0.4 DAV/2 X-Powered-By: PHP/5.0.4 Set-Cookie: PHPSESSID=bmmc3mfc94ncdr15ujitjogma3; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 1 Keep-Alive: timeout=15, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Content-Language: Off |
|
Quote: Original post posted by "First Request Server":
| The code is as follows | Copy code | ||||
GET /test.php HTTP/1.1
Accept: */*
|
|||||
| The code is as follows | Copy code |
| HTTP/1.1 200 OK Date: Fri, 26 Aug 2005 07:44:22 GMT Server: Apache/2.0.54 (Win32) SVN/1.2.1 PHP/5.0.4 DAV/2 X-Powered-By: PHP/5.0.4 Set-Cookie: PHPSESSID=bmmc3mfc94ncdr15ujitjogma3; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 1 Keep-Alive: timeout=15, max=99 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Content-Language: Off | |
| The code is as follows | Copy code |
| GET /test.php HTTP/1.1 Accept: */* Referer: http://localhost/ Accept-Language: zh-cn Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322) Host: localhost Connection: Keep-Alive Cookie: PHPSESSID=bmmc3mfc94ncdr15ujitjogma3 | |
引用：原帖由 "服务器第二次返回" 发表：
| 代码如下 | 复制代码 | ||||
HTTP/1.1 200 OK
|
|||||
Comparing these outputs carefully, the second request has more output than the first request:
Cookie: PHPSESSID=bmmc3mfc94ncdr15ujitjogma3
This header will send a cookie information to the server, telling the server that I have a cookie named PHPSESSID and the content is bmmc3mfc94ncdr15ujitjogma3.
Where did this cookie come from? Look at the information returned by the server for the first time:
Set-Cookie: PHPSESSID=bmmc3mfc94ncdr15ujitjogma3; path=/
This is when the server writes a cookie to the client browser. The name is PHPSESSID and the value is bmmc3mfc94ncdr15ujitjogma3. This value is actually the so-called session_id.
Continuing to look at the second request to the server, the PHPSESSID cookie is still sent to the server
Let’s take a look at session usage
Usage of session in php
Sessions in PHP use client cookies by default. When the client's cookies are disabled, it will automatically be passed through Query_String.
Php has a total of 11 functions for processing sessions. Let’s introduce in detail some of the functions we will use.
1. session_start
Function: Start a session or return an existing session.
Function prototype: boolean session_start(void);
Return value: Boolean value
Function description: This function has no parameters and the return value is true. It is best to put this function first, and there must be no output before it, otherwise an alarm will be issued, such as: Warning: Cannot send session cache limiter - headers already sent (output started at /usr/local/apache/htdocs/cga /member/1.php:2) in /usr/local/apache/htdocs/cga/member/1.php on line 3
2. session_register
Function: Register a new variable as a session variable
Function prototype: boolean session_register(string name);
Return value: Boolean value.
Function description: This function adds a variable to the current SESSION in the global variable. The parameter name is the name of the variable you want to add. If successful, it returns the logical value true. You can use the form $_SESSION[name] or $HTTP_SESSION_VARS[name] to get or assign a value.
3. session_is_registered
Function: Check whether the variable is registered as a session variable.
Function prototype: boobean session_is_registered(string name);
Return value: Boolean value
Function description: This function can check whether the specified variable has been registered in the current session. The parameter name is the variable name to be checked. If successful, the logical value true is returned.
4. session_unregister
Function: Delete registered variables.
Function prototype: boolean session_session_unregister(string name);
Return value: Boolean value
Function description: This function deletes variables in global variables in the current session. The parameter name is the name of the variable to be deleted, and returns true if successful.
5. Session_destroy
Function: End the current session and clear all resources in the session.
Function prototype: boolean session destroy(void);
Return value: Boolean value.
Function description: This function ends the current session. This function has no parameters and the return value is true
The functions introduced above will be used below, but there are also some session-related functions:
6. session_encode
Function: session information encoding
Function prototype: string session_encode(void);
Return value: string
Function description: The returned string contains the name and value of each variable in the global variable, in the form: a|s:12:"it is a test";c|s:4:"lala"; a is the variable name s :12 represents the value of variable a. "The length of it is a test is 12. The variables are separated by semicolon ";".
7. session_decode
Function: decoding session information
Function prototype: boolean session_decode (string data)
Return value: Boolean value
Function description: This function can decode session information and return the logical value true
if successful.
8. session_name
Function: access current session name
Function prototype: boolean session_name(string [name]);
Return value: string
Function description: This function can obtain or reset the name of the current session. If there is no parameter name, it means to get the current session name. Adding the parameter means setting the session name to the parameter name
9. session_id
Function: Access the current session identification number
Function prototype: boolean session_id(string [id]);
Return value: string
Function description: This function can obtain or reset the identification number of the currently stored session. If there is no parameter id, it means only getting the identification number of the current session. Adding the parameter means setting the session identification number to the newly specified id
10. session_unset
Function: Delete all registered variables.
Function prototype: void session_unset (void)
Return value: Boolean value
Function description: This function is different from Session_destroy in that it does not end the session. Just like using the function session_unregister to log out all session variables one by one
The following conclusions can be drawn:
1. As long as the session is used, the session will be sent to the client browser through cookies
2. Every time a request is made to the server, the local browser will attach the cookie to the request information