1

I have a large number of pages, each of which use a common header/footer. My wish is to keep the header and footer standard regardless of which page the user is on.

To access administration functions, the user presses an administration link at the bottom of the header. I would like this administrative login link to change to a log-out link after the user is logged in.

If I use session_start() in the header, then every page is going to have a session. I was told (I'm not sure if this is true or not) that it is bad practice to always have a session open.

Making matters worse in this regard, many of my pages use sessions (specifically all the administrative ones), and if you try and call start_session() after a header is sent (which obviously happens because my common header is parsed prior to the page content script sections being run, then it is an error.

To this point, I had been calling start_session() before the require line for the header on pages that would need sessions - but if the header now starts the session then this becomes an error.

If I need to know when an administrator is logged in within the common header code, how do I handle my session creation? Am I looking at this wrong?

4 Answers 4

2

I was told that it is bad practice to always have a session open.

yes. start your sessions only if you really need them.
otherwise it will make your site unnecessary slow, forbid browser from caching your pages when possible and such.

although you can't serve registered users without sessions, all other requests to the site (especailly from search engine bots) require no session support and there is no reason to start it.

how do I handle my session creation?

thre is a very simple solution.
call session_start() only on 2 occasions:

  • when user actully logs in.
  • when your script recieved a session identifier (means there is an active session running)

So, just add session_start() call right after the code checking user's password and modify all other calls this way

if (isset($_REQUEST[session_name()])) session_start();
2

There's the simple way of looking at sessions. If the page a user is on requires sessions, use sessions. Even if the page a user is on does not require sessions, if that page is one that a user reaches after a session has started, and it is reasonable to assume that a user will go from that page to another page that requires sessions, maintain the session. Don't keep starting and stopping your sessions. Just, as a rule of thumb, don't start the sessions until you need them and end them when you can be very confident that a user will not be needing them again during their visit.

1

In general, you are reinventing the wheel. Not using a CMS for these tasks is a waste of time and effort. In specifics, ob_start() is your friend.

0

I was told (I'm not sure if this is true or not) that it is bad practice to always have a session open.

That is hugely false. StackOverflow, Google, Facebook, etc. would all cease to function without an always-on session.

6
  • any site with user management uses sessions\cookies on every page.
    – user557846
    Nov 20, 2011 at 3:25
  • Oh, I'm sure there's a couple out there using some lunatic alternate approach.
    – ceejayoz
    Nov 20, 2011 at 3:29
  • http being stateless I can't think of an alternative.
    – user557846
    Nov 20, 2011 at 3:36
  • You could make it so every link in the site includes their session data as GET parameters. I've seen that, scary as it may sound.
    – ceejayoz
    Nov 20, 2011 at 3:43
  • There's no reason to start a session if you dont need to. That's how CDN'd content works.
    – chx
    Nov 20, 2011 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.