Question about sessions

How much info can one session handle effectively?

[IamStang]

I am developing a php app that needs to display several pieces of information on every page. I know I can make a call to the database on every load and retrieve the info. However, I am wondering if it might not be better to pass the info in a session from page to page.

The main concerns I have with passing the info via sessions are:

How much info can one pass via sessions effectively?

And is it really the benefit that it seems to be in my head?

Thanks!
IamStang

[eeek]

The session data is stored in a file so you can have quite a bit. But remember that the data is read into the $_SESSION array when the script runs so don't have so much that you run out of memory.

[jatar_k]

>> is it really the benefit that it seems to be in my head

yes, it really is

questions though

1. is this for a logged in section of the site?
2. how much data are we talking?
3. is this user specific data?

as an aside, I had a slow sign up page once and I couldn't figure it out. I started dumping vars trying to figure out what the genius programmer before thought was a good idea.

It seems his great idea was to stuff the full text of the User Agreement into the session once they agreed to it.

Once I stopped storing 60,000 chars into the session the signup process was lightning fast.

So sessions can take quite a bit ;)

[IamStang]

Thanks eek for your response!

And to jatar_k:

1. is this for a logged in section of the site?
2. how much data are we talking?
3. is this user specific data?

1 ... Yes
2 ... I am not completely sure as the whole of the code is not complete but would probably be around 150-200 characters.
3 ... Yes. However, none of the info is considered to be a security risk. (ie, no passwords, etc).

Thanks for your time folks!
IamStang

[eeek]

Why would 60kb of session data slow you down that much?

[IamStang]

And another question while we are on the subject. Would it be better to pass the info in one session and explode it each time?

Or better to do:
$one =$_SESSION['one'];
$two =$_SESSION['two'];
etc.?

Thanks again!

[eeek]

I suspect they'd be about the same. But if you really want to know, do the experiment. Otherwise, don't fret.

[jatar_k]

I put them each in their own variable, the exploding method is more of a cookie throwback. ;)

>> Why would 60kb of session data slow you down that much?

they were reading the file into a var then outputting that var and also popping it into the session. They were dealing with the same chunk of data about five times, fools.

so logged in section
very small amount of data
user specific - I asked mainly because if it is site wide info then there is no point lugging it around in the session. Good call about the security but it isn't really too much of an issue, session info is stored on your server.

populate the session with the most common data that will be needed across the site at login. Users expect to wait a moment or two when they login to a site. Doing work at that time to speed up the rest of the site makes a lot of sense. Though stay away from data or information that is only needed in a small portion of the site or a single script, use a db hit there to grab that info.

Remember to make sure your sessions time out and to watch for session hijacking

[IamStang]

Thanks again eek and jatar_k!

I currently have my sessions to timeout after 15 minutes of inacivity.

I also have a piece of code that checks info (md5 of browser and a security code) stored in the session, a cookie and in the database.

Anything else I can do to guard against session hijacking?

Thanks again!

[jatar_k]

that sounds pretty good

I usually time out after 5mins but that really depends on what people are doing and how sensitive data in the member's section is.

[IamStang]

Thanks again fellas.

Your help is appreciated greatly!