php sessions

[sharpenyourteeth]

I've made a small website for a teacher at my school. I'm having one small problem though. There are protected pages and you have to register and login to view them. Once the user is verified, they get a session variable called 'logged_in' which is set to '1'. The protected pages check to see if this variable is set and if it is equal to '1' before sending them the page, if it is not set they are sent to the logon page.
I can't recreate what he says is happening to him, but he says that if he views the protected pages, leaves his browser open for a long time (hours), possibly going to other websites, and then tries to go back and view a protectd page again, the page takes a long time to load and eventually just returns a 404 error. Any idea what may be causing this? The session cookie on his browser shouldn't be deleted since he never closes it. I know the session data on the server will eventually be erased, but that should just result in him having to log on again, not make the page never load, right? I have no idea what could be causing this. Thanks for any help.

 

[Sarekai]

I've made a small website for a teacher at my school. I'm having one small problem though. There are protected pages and you have to register and login to view them. Once the user is verified, they get a session variable called 'logged_in' which is set to '1'. The protected pages check to see if this variable is set and if it is equal to '1' before sending them the page, if it is not set they are sent to the logon page.
I can't recreate what he says is happening to him, but he says that if he views the protected pages, leaves his browser open for a long time (hours), possibly going to other websites, and then tries to go back and view a protectd page again, the page takes a long time to load and eventually just returns a 404 error. Any idea what may be causing this? The session cookie on his browser shouldn't be deleted since he never closes it. I know the session data on the server will eventually be erased, but that should just result in him having to log on again, not make the page never load, right? I have no idea what could be causing this. Thanks for any help.

I am not a PHP programmer. However, I do know in Windoze world (asp/iis) that maintaing "state" can be troublesome, especially if you are using session variables. If he encounters the problem again, he should close all his web browsers and try to access the page again. It might help to reload the page with a shift-reload as well. Also - I know in asp you can adjust the session variable timeout value - perhaps php can do the same. Might want to also check Apaches config to see if there isn't anything you can do server side.
Lastly, you could move away from session variables and actually write to a cookie. I know in (asp/iis) session variables are not the same as a cookie, not sure about php.

hope this helps.

 

[MadJuggla9]

go to php.net and lookup session, ill print you some sample code as soon as i can, but u may have it done by then. it was a PITA to setup, but now that i got it working its easy. You may also want to think about HTML parsing to prevent injection scripts depending on the application.

 

[devourment77]

I believe the default php session timeout is 20 minutes, that could be why he is experiencing odd issues. Are you redirecting to a specific page if the session var is not valid (like back to index?).

You can up the default session timeout to as long as you want, and I usually do it via an .htaccess file, but you can also do it in the php.ini file.