Does it matter if I create a PHP session before creating a cookie-based session?
up vote
-1
down vote
favorite
I'm a beginner but I can't seem to find the answer.
I'm working on a project with a login system and it will require both PHP sessions and cookies.
As I understand, sessions with user-side cookies or PHP (I know these are basically server side cookies) both have to have their code in the header/before the tag.
I've learned that coding semantics can be particular so I'm wondering which session code goes first, or do you create them at the same time?
php session-cookies
asked Nov 10 at 22:34
adraedin
715
add a comment |
up vote
-1
down vote
favorite
I'm a beginner but I can't seem to find the answer.
I'm working on a project with a login system and it will require both PHP sessions and cookies.
As I understand, sessions with user-side cookies or PHP (I know these are basically server side cookies) both have to have their code in the header/before the tag.
I've learned that coding semantics can be particular so I'm wondering which session code goes first, or do you create them at the same time?
php session-cookies
asked Nov 10 at 22:34
adraedin
715
No it doesn't matter. Just make sure anything that touches your headers is done before you output anything. And remember that if you aren't using session data, you have to assume anything coming in via the cookie is malicious. Sanitize and error check everything.
– miken32
Nov 10 at 22:41
Thanks for the answer. And thanks for the wise reminder regarding potentially malicious cookies.
– adraedin
Nov 10 at 22:51
add a comment |
up vote
-1
down vote
favorite
up vote
-1
down vote
favorite
I'm a beginner but I can't seem to find the answer.
I'm working on a project with a login system and it will require both PHP sessions and cookies.
As I understand, sessions with user-side cookies or PHP (I know these are basically server side cookies) both have to have their code in the header/before the tag.
I've learned that coding semantics can be particular so I'm wondering which session code goes first, or do you create them at the same time?
php session-cookies
asked Nov 10 at 22:34
adraedin
715
I'm a beginner but I can't seem to find the answer.
I'm working on a project with a login system and it will require both PHP sessions and cookies.
As I understand, sessions with user-side cookies or PHP (I know these are basically server side cookies) both have to have their code in the header/before the tag.
I've learned that coding semantics can be particular so I'm wondering which session code goes first, or do you create them at the same time?
php session-cookies
php session-cookies
asked Nov 10 at 22:34
adraedin
715
asked Nov 10 at 22:34
adraedin
715
asked Nov 10 at 22:34
adraedin
715
asked Nov 10 at 22:34
adraedin
715
asked Nov 10 at 22:34
adraedin
715
715
No it doesn't matter. Just make sure anything that touches your headers is done before you output anything. And remember that if you aren't using session data, you have to assume anything coming in via the cookie is malicious. Sanitize and error check everything.
– miken32
Nov 10 at 22:41
Thanks for the answer. And thanks for the wise reminder regarding potentially malicious cookies.
– adraedin
Nov 10 at 22:51
add a comment |
No it doesn't matter. Just make sure anything that touches your headers is done before you output anything. And remember that if you aren't using session data, you have to assume anything coming in via the cookie is malicious. Sanitize and error check everything.
– miken32
Nov 10 at 22:41
Thanks for the answer. And thanks for the wise reminder regarding potentially malicious cookies.
– adraedin
Nov 10 at 22:51
No it doesn't matter. Just make sure anything that touches your headers is done before you output anything. And remember that if you aren't using session data, you have to assume anything coming in via the cookie is malicious. Sanitize and error check everything.
– miken32
Nov 10 at 22:41
No it doesn't matter. Just make sure anything that touches your headers is done before you output anything. And remember that if you aren't using session data, you have to assume anything coming in via the cookie is malicious. Sanitize and error check everything.
– miken32
Nov 10 at 22:41
Thanks for the answer. And thanks for the wise reminder regarding potentially malicious cookies.
– adraedin
Nov 10 at 22:51
Thanks for the answer. And thanks for the wise reminder regarding potentially malicious cookies.
– adraedin
Nov 10 at 22:51
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
Some more pointers:
Cookies are sent with HTTP headers that must be sent before any other output including any html or whitespace.
php have session_start() and related functions that gets/sets session stuff for you
With a started session, you can use the $_SESSION array to store data between multiple requests. You want to put your user_id etc there.
It isn't hard to implement the session stuff yourself. You may want to do it for learning purposes, or if you have a complex system. In this case, make sure you sanitize cookie values and security check everything
answered Nov 10 at 22:57
Eriks Klotins
918516
Thanks for those pointers as well.
– adraedin
Nov 10 at 23:37
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53244093%2fdoes-it-matter-if-i-create-a-php-session-before-creating-a-cookie-based-session%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
Some more pointers:
Cookies are sent with HTTP headers that must be sent before any other output including any html or whitespace.
php have session_start() and related functions that gets/sets session stuff for you
With a started session, you can use the $_SESSION array to store data between multiple requests. You want to put your user_id etc there.
It isn't hard to implement the session stuff yourself. You may want to do it for learning purposes, or if you have a complex system. In this case, make sure you sanitize cookie values and security check everything
answered Nov 10 at 22:57
Eriks Klotins
918516
Thanks for those pointers as well.
– adraedin
Nov 10 at 23:37
add a comment |
up vote
0
down vote
Some more pointers:
Cookies are sent with HTTP headers that must be sent before any other output including any html or whitespace.
php have session_start() and related functions that gets/sets session stuff for you
With a started session, you can use the $_SESSION array to store data between multiple requests. You want to put your user_id etc there.
It isn't hard to implement the session stuff yourself. You may want to do it for learning purposes, or if you have a complex system. In this case, make sure you sanitize cookie values and security check everything
answered Nov 10 at 22:57
Eriks Klotins
918516
Thanks for those pointers as well.
– adraedin
Nov 10 at 23:37
add a comment |
up vote
0
down vote
up vote
0
down vote
Some more pointers:
Cookies are sent with HTTP headers that must be sent before any other output including any html or whitespace.
php have session_start() and related functions that gets/sets session stuff for you
With a started session, you can use the $_SESSION array to store data between multiple requests. You want to put your user_id etc there.
It isn't hard to implement the session stuff yourself. You may want to do it for learning purposes, or if you have a complex system. In this case, make sure you sanitize cookie values and security check everything
answered Nov 10 at 22:57
Eriks Klotins
918516
Some more pointers:
Cookies are sent with HTTP headers that must be sent before any other output including any html or whitespace.
php have session_start() and related functions that gets/sets session stuff for you
With a started session, you can use the $_SESSION array to store data between multiple requests. You want to put your user_id etc there.
It isn't hard to implement the session stuff yourself. You may want to do it for learning purposes, or if you have a complex system. In this case, make sure you sanitize cookie values and security check everything
answered Nov 10 at 22:57
Eriks Klotins
918516
answered Nov 10 at 22:57
Eriks Klotins
918516
answered Nov 10 at 22:57
Eriks Klotins
918516
answered Nov 10 at 22:57
Eriks Klotins
918516
918516
Thanks for those pointers as well.
– adraedin
Nov 10 at 23:37
add a comment |
Thanks for those pointers as well.
– adraedin
Nov 10 at 23:37
Thanks for those pointers as well.
– adraedin
Nov 10 at 23:37
Thanks for those pointers as well.
– adraedin
Nov 10 at 23:37
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53244093%2fdoes-it-matter-if-i-create-a-php-session-before-creating-a-cookie-based-session%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
No it doesn't matter. Just make sure anything that touches your headers is done before you output anything. And remember that if you aren't using session data, you have to assume anything coming in via the cookie is malicious. Sanitize and error check everything.
– miken32
Nov 10 at 22:41
Thanks for the answer. And thanks for the wise reminder regarding potentially malicious cookies.
– adraedin
Nov 10 at 22:51