[an error occurred while processing this directive]

<div class="slide titleslide">
	<h1>14.3: Sessions</h1>

	<ul>
		<li>
			14.1: Cookie Basics
		</li>
		<li>
			14.2: Programming with Cookies
		</li>
		<li>
			<strong>14.3: Sessions</strong>
		</li>
	</ul>
</div>



<div class="slide">
	<h1>How long does a cookie exist?</h1>

	<ul>
		<li><span class="term">session cookie</span> : the default type; a temporary cookie that is stored only in the browser's memory
			<ul>
				<li>when the browser is closed, temporary cookies will be erased</li>
				<li>can not be used for tracking long-term information</li>
				<li>safer, because no programs other than the browser can access them</li>
			</ul>
		</li>
		<li><span class="term">persistent cookie</span> : one that is stored in a file on the browser's computer
			<ul>
				<li>can track long-term information</li>
				<li>potentially less secure, because users (or programs they run) can open cookie files, see/change the cookie values, etc.</li>
			</ul>
		</li>
	</ul>
</div>



<div class="slide">
	<h1>What is a session?</h1>

	<ul>
		<li><span class="term">session</span>: an abstract concept to represent a series of HTTP requests and responses between a specific Web browser and server
			<ul>
				<li>HTTP doesn't support the notion of a session, but PHP does</li>
			</ul>
		</li>

		<li class="incremental">sessions vs. cookies:
			<ul>
				<li>a cookie is data stored on the client</li>
				<li>a session's data is stored on the server (only 1 session per client)</li>
			</ul>
		</li>

		<li class="incremental">sessions are often built on top of cookies:
			<ul>
				<li>the only data the client stores is a cookie holding a unique <span class="term">session ID</span></li>
				<li>on each page request, the client sends its session ID cookie, and the server uses this to find and retrieve the client's session data</li>
			</ul>
		</li>
	</ul>
</div>



<!-- ***
shopping cart example
-->

<!--
<div class="slide">
<h1>Characteristics of sessions</h1>

<ul>
<li>Information or state must be stored. For example, a selected bottle of wine in a shopping cart, a customer name, or a credit card number must be maintained across multiple HTTP requests.</li>
<li>Each HTTP request must carry an identifier that allows the server to process the request in the context of the stored state. For example, when an order is submitted, it must be processed with the correct items and customer details.</li>
<li>Sessions need to have a timeout . Otherwise, if a user leaves the web site, there is no way the server can tell when the session should end</li>
</ul>

</div>
-->



<div class="slide">
	<h1>How sessions are established</h1>

	<div class="rightfigure">
		<img src="images/session.gif" style="max-width: 100%" alt="session" />
	</div>

	<ul>
		<li>client's browser makes an initial request to the server</li>
		<li>server notes client's IP address/browser, stores some local session data, and sends a <strong>session ID</strong> back to client (as a cookie)</li>
		<li>client sends that same session ID (cookie) back to server on future requests</li>
		<li>server uses session ID cookie to retrieve its data for the client's session later (like a ticket given at a coat-check room)</li>
	</ul>
</div>



<div class="slide">
	<h1>Cookies vs. sessions</h1>

	<div class="rightfigure">
		<img src="images/cookie-monster-google.jpg" alt="cookie monster" />
	</div>

	<ul>
		<li>
			<strong>duration:</strong> sessions live on until the user logs out or closes the browser; cookies can live that long, or until a given fixed timeout (persistent)
		</li>

		<li>
			<strong>data storage location:</strong> sessions store data on the server (other than a session ID cookie); cookies store data on the user's browser
		</li>

		<li>
			<strong>security:</strong> sessions are hard for malicious users to tamper with or remove; cookies are easy
		</li>

		<li>
			<strong>privacy:</strong> sessions protect private information from being seen by other users of your computer; cookies do not
		</li>
	</ul>
</div>



<div class="slide">
	<h1>Sessions in PHP: <code>session_start</code></h1>

	<pre class="examplecode php">
session_start();
</pre>

	<ul>
		<li><code>session_start</code> signifies your script wants a session with the user
			<ul>
				<li>must be called at the top of your script, before any HTML output is produced</li>
			</ul>
		</li>
		<li>when you call <code>session_start</code>:
			<ul>
				<li>if the server hasn't seen this user before, a new session is created</li>
				<li>otherwise, existing session data is loaded into <code>$_SESSION</code> associative array</li>
				<li>you can store data in <code>$_SESSION</code> and retrieve it on future pages</li>
			</ul>
		</li>
		<li><a href="http://us.php.net/manual/en/ref.session.php">complete list of PHP session functions</a></li>
	</ul>
</div>



<div class="slide">
	<h1>Accessing session data</h1>

	<pre class="syntaxtemplate php">
$_SESSION[&quot;<var>name</var>&quot;] = <var>value</var>;        <span class="comment"># store session data</span>
$<var>variable</var> = $_SESSION[&quot;<var>name</var>&quot;];     <span class="comment"># read session data</span>
if (isset($_SESSION[&quot;<var>name</var>&quot;])) {  <span class="comment"># check for session data</span>
</pre>

	<pre class="examplecode php">
if (<em>isset($_SESSION[&quot;points&quot;])</em>) {
	$points = <em>$_SESSION[&quot;points&quot;]</em>;
	print(&quot;You've earned $points points.\n&quot;);
} else {
	<em>$_SESSION[&quot;points&quot;]</em> = 0;  <span class="comment"># default</span>
}
</pre>

	<ul>
		<li>the <code>$_SESSION</code> associative array reads/stores all session data</li>
		<li>use <a href="http://php.net/isset"><code>isset</code></a> function to see whether a given value is in the session</li>
	</ul>

	<!--
	$_SESSION[]
	isset
	unset

	if ($_SESSION && array_key_exists("lastsearch", $_SESSION)) {
	if (isset($_SESSION["lastsearch"])) {

	-->
</div>



<div class="slide">
	<h1>Where is session data stored?</h1>

	<div class="rightfigure">
		<img src="images/firefox_session_cookie.png" alt="session cookie" />
	</div>

	<ul>
		<li>on the client, the session ID is stored as a cookie with the name <code>PHPSESSID</code></li>
		<li>on the server, session data are stored as temporary files such as
			<code>/tmp/sess_fcc17f071...</code>
		</li>
		<li>you can find out (or change) the folder where session data is saved using the <a href="http://us.php.net/manual/en/function.session-save-path.php"><code>session_save_path</code></a> function</li>
		<li>for very large applications, session data can be stored into a SQL database (or other destination) instead using the <a href="http://www.php.net/manual/en/function.session-set-save-handler.php"><code>session_set_save_handler</code></a> function</li>
	</ul>
</div>



<div class="slide">
	<h1>Session timeout</h1>

	<ul>
		<li>because HTTP is stateless, it is hard for the server to know when a user has finished a session</li>
		<li>ideally, user explicitly logs out, but many users don't</li>
		<li>client deletes session cookies when browser closes</li>
		<li>server automatically cleans up old sessions after a period of time
			<ul>
				<li>old session data consumes resources and may present a security risk</li>
				<li>adjustable in PHP server settings or with <a href="http://php.net/manual/en/function.session-cache-expire.php"><code>session_cache_expire</code></a> function</li>
				<li>you can explicitly delete a session by calling <a href="http://us.php.net/manual/en/function.session-destroy.php"><code>session_destroy</code></a></li>
			</ul>
		</li>
	</ul>
</div>



<!--
<div class="slide">
	<h1>Browsers that don't support cookies</h1>

	<pre class="examplecode php">
session_start();   <span class="comment"># same as usual</span>

<span class="comment"># Generate a URL to link to one of our site's pages
# (you probably won't ever need to do this)</span>
$orderUrl = &quot;/order.php<em>?PHPSESSID=</em>&quot; . <em>session_id()</em>;
</pre>

	<ul>
		<li>if a client's browser doesn't support cookies, it can still send a session ID as a query string parameter named <code>PHPSESSID</code>
			<ul>
				<li>this is done automatically; <code>session_start</code> detects whether the browser supports cookies and chooses the right method</li>
			</ul>
		</li>
		<li>if necessary (such as to build a URL for a link on the page), the server can find out the client's session ID by calling the <a href="http://us.php.net/manual/en/function.session-id.php"><code>session_id</code></a> function</li>
	</ul>
</div>
-->



<div class="slide">
	<h1>Ending a session</h1>

	<pre class="examplecode php">
session_destroy();
</pre>

	<ul>
		<li><code>session_destroy</code> ends your current session
		<li>potential problem: if you call <code>session_start</code> again later, it sometimes reuses the same session ID/data you used before</li>
		<li>if you may want to start a completely new empty session later, it is best to flush out the old one:
			<pre class="examplecode php">
session_destroy();
<em>session_regenerate_id(TRUE);</em>   <span class="comment"># flushes out session ID number</span>
session_start();
</pre>
		</li>
	</ul>
</div>



<div class="slide">
	<h1>Common session bugs</h1>

	<ul>
		<li>
			<code>session_start</code> doesn't just begin a session; it also reloads any existing session for this user.  So it must be called in every page that uses your session data:
			<pre class="examplecode php">
<span class="comment"># the user has a session from a previous page</span>
<em class="bad">print $_SESSION["name"];</em>   <span class="comment"># undefined</span>

<em class="good">session_start();</em>
print $_SESSION["name"];   <span class="comment"># joe</span>
</pre>
		</li>
		<li>
			previous sessions will linger unless you destroy them and regenerate the user's session ID:
			<pre class="examplecode php">
<em class="good">session_destroy();
session_regenerate_id(TRUE);</em>
session_start();
</pre>
		</li>
	</ul>
</div>



<div class="slide">
	<h1>Practice problem: Power Animal</h1>

	<div class="rightfigure">
		<img src="images/power-animal-bee.png" alt="power animal" /> <br />
		<img src="images/power-animal-yak.png" alt="power animal" />
	</div>

	<ul>
		<li>Write a page <code>poweranimal.php</code> that chooses a random "power animal" for the user.</li>
		<li>The page should remember what animal was chosen for the user and show it again each time they visit the page.</li>
		<li>It should also count the number of times that user has visited the page.</li>
		<li>If the user selects to "start over," the animal and number of page visits should be forgotten.</li>
	</ul>
</div>



<div class="slide">
	<h1>Implementing user logins</h1>
	
	<div class="rightfigure">
		<img src="images/user-login.gif" alt="user login" />
	</div>

	<ul>
		<li>many sites have the ability to create accounts and log in users</li>
		<li>most apps have a database of user accounts</li>
		<li>when you try to log in, your name/pw are compared to those in the database</li>
	</ul>
</div>



<div class="slide">
	<h1>"Remember Me" feature</h1>
	
	<div class="rightfigure">
		<img src="images/user-login-remember.gif" alt="user login" />
	</div>

	<ul>
		<li>How might an app implement a "Remember Me" feature, where the user's login info is remembered and reused when the user comes back later?</li>
		<li>Is this stored as session data?  Why or why not?</li>
		<li>What concerns come up when trying to remember data about the user who has logged in?</li>
	</ul>
</div>






<!--
<div class="slide">
	<h1>Practice problem: remembering query</h1>

	<ul>
		<li>Modify the <code>movie.php</code> movie search script from previous lectures so that it remembers the current user's last query (if any), and offers the user a chance to search for it again, such as:

			<ul>
				<li>Welcome back!  Would you like to repeat your recent search for <a href="movie.php?movie=Fight%20Club">Fight Club</a>?</li>
			</ul>
		</li>

		<li class="incremental">Pretend that the movie-search program is running on a system that wants to limit repeated usage by particular users.  Add code so that a given user can only conduct one session per day.</li>
	</ul>
</div>
-->



[an error occurred while processing this directive]