CODEWITHSUNDEEP
phpsession
Olivier Pons
Olivier Pons

Reputation: 15778

File session: is it always generated?

Does Php always create a session file as soon as session_start() is called, even though there's nothing to keep track of (= no variable written in $_SESSION[])? If so, why?

Upvotes: 0

Views: 225

Answers (1)

Marc B
Marc B

Reputation: 360592

Default PHP file-based sessions encode the session ID into the session file's filename. Since that's the only place the ID is kept normally, SOMETHING has to be kept to store the id. That means you'll get a file created, even if nothing is EVER written to $_SESSION.

In PHP-like pseudo code, basically this is occuring:

function session_start() {
     if (isset($_COOKIE[ini_get('session.name')])) {
           // session ID was sent from client, get it
           $id = $_COOKIE[ini_get('session.name')];
     } else {
           // no session ID received, generate one
           $id = generate_new_id();
           setcookie(ini_get('session.name'), $id, ......);
     }
     $session_file = ini_get('session.save_path') . '/sess_' . $id;
     if (file_exists($session_file)) {
        // found a session file, load it
        $raw_data = file_get_contents($session_file);
        $_SESSION = unserialize($raw_data);
     } else {
        // brand new session, create file and initialize empty session
        file_put_contents($session_file, serialize(array());
        $_SESSION = array();
     }
     // lock the session file to prevent parallel overwrites.
     flock($session_file);
}

Upvotes: 2

Related Questions