Session Time Out

[wener]

Hi,
I activate a session when a script is processed to get results from mysql. And I will save the "total_items" and "last_query" in the session variables when the visitor send the query for the first time, so that when the same query is sent again by the same visitor, the script will modify the query by adding "LIMIT, start, itemsperpage" to only get the needed number of rows from the database.

My question is: the session Time Out period is 180 minutes. If I delete a product or add a product within this 180 minutes, visitors who are in a session still see the old "total_items" and will get an empty product entry which is just deleted or will not see the new prodcuts I just add. Is there any solution to this? Thanks.

[coopster]

That's a very realistic issue even without a lengthy time lapse. Every time a user requests a page it is *fresh* information from the server. If User1 gets a product list and one second later you delete a product that User1 happens to have in their current list ... well, you get the picture. The listing is only as fresh as the last request because every call to and from the server is disconnected. A user requests data, you push it to them and the communication link is disconnected. HTTP is a stateless protocol.

You always have to verify existence. Not just for this purpose, but for other reasons as well, security being one of them. What if the user doesn't have a certain product in their list because it isn't supposed to be available to them but they notice in the link how the product request works ...

http://www.example.com/productlist.php?product=BronzeTrophy

Hey, I want Gold. So rather than use your link, I key my own into the address bar ...

http://www.example.com/productlist.php?product=GoldTrophy

Not a real great example, but you get the idea hopefully. Take it to the next level. You have a link ...

http://www.example.com/productlist.php?product=GoldTrophy&price=1000

See where this is going?