# Session Handling

# Introduction

Session support in PHP consists of a way to preserve certain data across subsequent accesses.

A visitor accessing your web site is assigned a unique id, the so-called session id. This is either stored in a cookie on the user side or is propagated in the URL.

The session support allows you to store data between requests in the $_SESSION superglobal array. When a visitor accesses your site, PHP will check automatically (if session.auto_start is set to 1) or on your request (explicitly through session_start()) whether a specific session id has been sent with the request. If this is the case, the prior saved environment is recreated.

Caution

If you turn on session.auto_start then the only way to put objects into your sessions is to load its class definition using auto_prepend_file in which you load the class definition else you will have to serialize() your object and unserialize() it afterwards.

$_SESSION (and all registered variables) are serialized internally by PHP using the serialization handler specified by the session.serialize_handler ini setting, after the request finishes. Registered variables which are undefined are marked as being not defined. On subsequent accesses, these are not defined by the session module unless the user defines them later.

Warning

Because session data is serialized, resource variables cannot be stored in the session.

Serialize handlers (`php` and `php_binary`) inherit register_globals limitations. Therefore, numeric index or string index contains special characters (`|` and `!`) cannot be used. Using these will end up with errors at script shutdown. `php_serialize` does not have such limitations.

> Note:

> Please note when working with sessions that a record of a session is not created until a variable has been registered by adding a new key to the $_SESSION superglobal array. This holds true regardless of if a session has been started using the session_start() function.

- Installing/Configuring
  - Requirements
  - Installation
  - Runtime Configuration
- Predefined Constants
- Examples
  - Basic usage
  - Passing the Session ID
  - Custom Session Handlers
- Session Upload Progress
- Sessions and Security
  - Session Management Basics
  - Securing Session INI Settings
- Session Functions
  - session_abort — Discard session array changes and finish session
  - session_cache_expire — Get and/or set current cache expire
  - session_cache_limiter — Get and/or set the current cache limiter
  - session_commit — Alias of session_write_close
  - session_create_id — Create new session id
  - session_decode — Decodes session data from a session encoded string
  - session_destroy — Destroys all data registered to a session
  - session_encode — Encodes the current session data as a session encoded string
  - session_gc — Perform session data garbage collection
  - session_get_cookie_params — Get the session cookie parameters
  - session_id — Get and/or set the current session id
  - session_module_name — Get and/or set the current session module
  - session_name — Get and/or set the current session name
  - session_regenerate_id — Update the current session id with a newly generated one
  - session_register_shutdown — Session shutdown function
  - session_reset — Re-initialize session array with original values
  - session_save_path — Get and/or set the current session save path
  - session_set_cookie_params — Set the session cookie parameters
  - session_set_save_handler — Sets user-level session storage functions
  - session_start — Start new or resume existing session
  - session_status — Returns the current session status
  - session_unset — Free all session variables
  - session_write_close — Write session data and end session
- SessionHandler — The SessionHandler class
  - SessionHandler::close — Close the session
  - SessionHandler::create_sid — Return a new session ID
  - SessionHandler::destroy — Destroy a session
  - SessionHandler::gc — Cleanup old sessions
  - SessionHandler::open — Initialize session
  - SessionHandler::read — Read session data
  - SessionHandler::write — Write session data
- SessionHandlerInterface — The SessionHandlerInterface class
  - SessionHandlerInterface::close — Close the session
  - SessionHandlerInterface::destroy — Destroy a session
  - SessionHandlerInterface::gc — Cleanup old sessions
  - SessionHandlerInterface::open — Initialize session
  - SessionHandlerInterface::read — Read session data
  - SessionHandlerInterface::write — Write session data
- SessionIdInterface — The SessionIdInterface interface
  - SessionIdInterface::create_sid — Create session ID
- SessionUpdateTimestampHandlerInterface — The SessionUpdateTimestampHandlerInterface interface
  - SessionUpdateTimestampHandlerInterface::updateTimestamp — Update timestamp
  - SessionUpdateTimestampHandlerInterface::validateId — Validate ID

`↑` and `↓` to navigate • `Enter` to select • `Esc` to close • `/` to open