Php Custom session safe handler safe data as json

Question

I´m trying to setup a custom session safe handler which works so far. But I don´t want to store the data in PHP session format but pure JSON format. How do I have to change read and write functions to en-/decode the php session data to json.

function write($sessionId, $data) { 
    $db = new PDO("mysql:host=myhost;dbname=mydb", "myuser", "mypassword");

    $sql = "INSERT INTO session SET session_id =" . $db->quote($sessionId) . ", session_data =" . $db->quote($data) . " ON DUPLICATE KEY UPDATE session_data =" . $db->quote($data);
    $db->query($sql)
}

function read($sessionId) { 
    $db = new PDO("mysql:host=myhost;dbname=mydb", "myuser", "mypassword");

    $sql = "SELECT session_data FROM session where session_id =" . $db->quote($sessionId);
    $result = $db->query($sql);
    $data = $result->fetchColumn();
    $result->closeCursor();

    return $data;
}

The functions are from following tutorial. The author says:

PHP passes the data in serialized to the write function, and expects it serialized back from the read function, but that doesn’t mean you have to store it that way. You could unserialize the data immediately in the write callback and then perform some action dependent on the data or store it however you wish.

I´ve tried following functions which I thought would do the job?

json_encode()
json_decode()
serialize()
unserialize()

EDIT

If I´m not trying to json_encode the data, it´s written into db as expeceted in following format:

auth|b:1;LAST_ACTIVITY|i:1407480463;

Ray Perea · Accepted Answer · 2014-08-08 07:27:22Z

2

The session data that is passed to the write function is not unserializable.... There are some methods to do the unserialization manually, but they fail at one point or another depending on how complex your session data is. So, here is my solution.

Step 1. Create a new field in your table and name it something like "json" You will have to store both the json data and the php serialized format. You can use the json data however you like, but the $data that is passed into the write function MUST be returned exactly as passed in. And there is no (easy) way to do this correctly. So, instead, just look up the $_SESSION and encode that. Then store both the $data and json encoded version in your table. Your read operation only needs to return the $data that was passed into your write function.

function write($sessionId, $data) {
    $db = new PDO("mysql:host=myhost;dbname=mydb", "myuser", "mypassword");

    // Convert current $_SESSION to json because it hasn't been destroyed yet.
    $json = json_encode($_SESSION);

    $quotedSessId = $db->quote($sessionId);
    $quotedData = $db->quote($data);
    $quotedJson = $db->quote($json);

    $sql = "INSERT INTO session SET session_id = $quotedSessionId, session_data = $quotedData, json = $quotedJson ON DUPLICATE KEY UPDATE session_data = $quotedData, json = $quotedJson";
    $db->query($sql);
}

function read($sessionId) {
    $db = new PDO("mysql:host=myhost;dbname=mydb", "myuser", "mypassword");

    $sql = "SELECT session_data FROM session where session_id =" . $db->quote($sessionId);
    $result = $db->query($sql);

    $result->closeCursor();

    return $data;
}

edited Aug 8, 2014 at 7:27

answered Aug 8, 2014 at 6:19

Ray Perea

5,8791 gold badge38 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Anatol Over a year ago

thanks for this. yes this is how it should work unfortunately I´m getting "false" in my session coloumn.

Ray Perea Over a year ago

What if you don't try to json encode and instead just use the default functions? Do you get a valid serialized string in your column then? Perhaps this will give some insight as to why you are getting false.

Anatol Over a year ago

yes, if I´m not using json the php session format is written to the db as expected. mhhh but json is also string like php serialized session thought maybe thats the problem, a different data type, mhhh

Ray Perea Over a year ago

can you post an example of the php session format that is written to the db when not trying to convert to json?

Ray Perea Over a year ago

OK, it looks like the data that's handed to the write function is not in the normal format.... It's still possible, just some things to consider. I am editing my answer now.

|

Collectives™ on Stack Overflow

Php Custom session safe handler safe data as json

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related