Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: sessions timeout Date: Sun, 08 Jan 2012 20:17:58 +0100 Organization: A noiseless patient Spider Lines: 31 Message-ID: <4F09EBE6.3060907@arnowelzel.de> References: <66b7g7lk434p6vk68429d8np5134jd52hd@4ax.com> <4F040BE5.7000207@arnowelzel.de> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="Psb2+p0U7wkhKleuxO8/EQ"; logging-data="12117"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19tMCwR5cAXxEmu2RjfPANBne1RF6UsDHg=" User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:9.0) Gecko/20111222 Thunderbird/9.0.1 In-Reply-To: Cancel-Lock: sha1:VxJ7W4l58JeK9ywJDPXBYlXR9ZY= Xref: x330-a1.tempe.blueboxinc.net comp.lang.php:4313 The Natural Philosopher, 2012-01-04 11:51: [...] > Basically the code needs to do as a common FIRST THING in EVERY access > > get the cookie name/value pair and search your database for a value that > matches it, and is less than X minutes since it was stored in the database. Which means, nearly *every* access will result in a database access. [...] > I am sure you can get sessions to behave in this way, but it seems to me > its a poor substitute for a database, if you have one. For me it seems to be the opposite: A session can make things a lot easier, since you don't have to handle hundrets or thousands of database queries. Of course it makes sense to use a database to store user accounts - but it should only be checked *once* at the time of login and not at *every* request by the user. I alread did an example for session timeout handling a while ago - well, it also demonstrates using JavaScript to automatically tell the user that the session timed out, but it also works without JavaScript: See -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de