php session instead of cookie

[ahmed24]

I am currently setting a cookie and reading it like this:

setcookie("user", "Alex", $expire);

if (isset($_COOKIE["user"]))
echo "Welcome " . $_COOKIE["user"] . "<br>";
else
echo "Welcome guest";

How can I do the exact same thing but with PHP sessions so that as long as the current browser window is opened the session info will always remain?

thanks

[coopster]

You can use the session [php.net] cookie handlers.

[andrewsmd]

Almost the same syntax. You just have to set your session variable where you set that cookie for username $_SESSION['user'] = $username;

if (isset($_SESSION["user"]))
echo "Welcome " . $_SESSION["user"] . "<br>";
else
echo "Welcome guest";

[ahmed24]

thanks for your replies. will it be safe to store a users password in a session variable? i need to store the password so that i can log the user into certain applications automatically. or should i store it encrypted? and then decrypt it when needed?

[omoutop]

its relative safe but take note that the sessions have a limited life span (around 20-25 mins by default if page is idle all that time if i remember correctly or until the user closes the browser)

you can change that of course
but you cannot relog the user on next visit. You will force him to re-login manually

[andrewsmd]

If you want to save their log in after they close the browser for an extended period of time then you need to use a COOKIE. Also, for the security issue, you can store the passwords encrypted, but anything that can be decrypted can be hacked and someone could catch it. What I would recommend is having an encrypted session variable name with an encrypted value. Look at this php

//if the user is logged in set the variable to this
$_SESSION['userLogged'] = md5("loggedIn");

var_dump($_SESSION['userLogged']);

Just use their username to get their information, but check if that session variable equals that to see if they are logged in.

[penders]

...sessions have a limited life span (around 20-25 mins by default if page is idle...

Yes, default value of session.gc_maxlifetime is 1440 secs (24mins).

[andrewsmd]

Also, you can change your session time (if you run the server that hosts your website that is). If you have facebook open it sometime and just leave it open and see how their sessions are. It's a really long time.