PHP: thumb-rules for sessions

Question

I had to break my too complex project, about 100files, to small files. A problem is that it is still hard to see the logic, getting nice heap of session errors:

`Cannot send session cookie - headers already sent by`

How do you manage your session commands, such as "session-start" and "ob-end-flush"? Do you add them to the beginning and end of your index.php or have some centralised file to manage them?

Please, have one thumb-rule per answer.

Answer 1

Maybe you could just use session autostart to ensure that the session is started before any output?

http://us.php.net/manual/en/session.configuration.php#ini.session.auto-start

Answer 2

All that error generally means is that you've already output something. The way I always got round this was to use some templating engine to help me remember to only send output in one place, after I'm done doing everything else. I used smarty, but there's loads of others.

Answer 3

• Use some kind of response object to aggregate your data/headers.

  This allows you to be sure that you can send all headers simultaneously and start sessions only when necessary etc.

  Pros

  • Simplifies response handling.
  • Enables you to aggregate content, and send different output if an exception is thrown, since the client has not yet received any data

  Cons

  • You will not be able to send chunks of data to the client as early as possible

Answer 4

I generally put them at the start/end of index.php and then include() the content pages. This seems to be a robust solution as you can guarantee your session is started and will be cleaned up after the content.

Answer 5

Hi,

If you want your project to become logically well-organized, session management doesn't need to be in the beggining of the code .. In fact, if your code is well organized, you can even put it almost at the end of the process, if you care not to echo any kind of string before it.

Personally, I prefer to treat sessions and ob as different libraries (created by myself in php to be handled my way), and think that's the best sollution. But that deppends on what you want to achieve.

Answer 6

You need to use session_start() before any and all code that does any output (including, but not limited to sending headers, cookies) so the top section of the first file that gets executed during a pageload is a safe place.

Answer 7

You could use a custom session handler implemented as singleton that calls session_start when it’s initially created. Any further session operations are then performed on that session object.

The output controll issue can be solved by calling ob_start at the begin of your index script. Calling ob_end_flush is not necessary as the output buffer is flushed automatically at the end of the script execution.

Answer 8

This might not be what you are asking for, but just as a little hint:

I always leave the <?php tag open like this:

<?php
class foo {
    //...
}

//EOF

That way you can't have any line breaks(unintended output before the session started) after the ?> which would be very hard to trace down.

This convention is also used by the Zend Framework.