I was playing around with php.ini's session.start_auto and tried setting it to 1. The site I am building requires session management on every page anyways and the server only contains the one site. Is this considered bad practice (like having globals turned on - which I dont BTW!) - php.net doesn't say a lot about it.
4 Answers
Nah, why should it be? In principle, its the same as having session_start();
as the second line in every page.
-
1You are assuming that putting session_start() on every page is not a bad thing. If someone enters your site, reads some pages and then leaves, why would a session need to be created? It's pretty rare that ALL your pages needs a session. Jan 22, 2019 at 18:48
-
@DanieleTesta, yes, but the question explicitly said that his every page indeed uses the session. (Otherwise yes, there are good reasons to avoid the default PHP session setup, e.g. if you need to customize properties of the session cookie.)– Sz.Jun 7, 2020 at 2:46
IMO relying on
php.ini
settings can be tricky if people deploying your app don't have control on thephp.ini
(e.g. shared hosting). And even if thephp.ini
can be changed, understanding a problem due to aphp.ini
configuration problem may be difficult to understand (you may have to write a script allowing to check if config is Ok, etc.).As an alternative, you can create a unique "controller" script (e.g.
/index.php
), which will call and output different pages depending on parameters sent to it (e.g.yoursite.com/index.php?page=12
or even betteryoursite.com/page/12
with routing & URL rewriting). And in that index.php file, put yoursession_start()
once for all pages.
-
I'd have voted this up for the first point, but voted it down for suggesting a front controller as a solution %) (you could get the same benefit by using an auto-prepend without having to rewrite the entire site - and if you are rewritnig the entire site, wouldn't it be simpler to just add session_start()...not to mention all the other issues with FC)– symcbeanNov 24, 2011 at 13:21
-
@symcbean
auto_prepend_file
relies onphp.ini
too. IMO using a FC is preferable to repeatingsession_start();
on every page: pros look far stronger than cons, see stackoverflow.com/questions/121849/… stackoverflow.com/questions/3538242/… css.dzone.com/books/practical-php-patterns/… Nov 24, 2011 at 13:40
To be honest, I would consider it BAD to turn auto_session on. Like other people said, it is the same thing as putting a session_start() on ALL your pages.
Imagine all people that enters the main page of your website. A session will be created even before they tried to login or anything else. All spam-bots, all search engine bots etc will all create a session when entering your page. This is usually a bad thing as it will create TONS of files on your server (if session is file-based) or fill your ram cache (if session is memcache based).
It's much better to simply run session_start() only when you actually NEED a session. You can just create a "session class" or simple functions like session_get() and session_put() which will run session_start() for you. Then use those instead of $_SESSION directly.
I would say the answer is "yes, it is bad practice."
[disclaimer: I started building web pages in 1997 -- when you coded everything by hand, so I have developed my own way of doing things.]
In my world, I have a MySessionHandler which extends SessionHandler. It pulls in an INI file that contains all of the ini_set commands needed. I note that I am not the only one who does this. If you auto-start the session (which happens before the code gets executed), then a number of the frameworks also have issues.
The first line of executable code in my PHP scripts is a require of MySessionHandler.php, which starts off by checking the values of auto-start and use_strict_mode, optionally dying with an error if they are not set properly.
if (ini_get('session.auto_start') == 0) session_start();
to prevent Notices