session timeout

[chramya]

Hi,

Am new to PHP... i create login form with session.. i wish to set my code as if after login i was idle for sometime means it should destroy the session and should go to login form once again..

How can i do this... Pls let me know by some samples codes...

Thanks,

[PeejAvery]

There are a number of ways to do this. Since you are new, let's look at an easy method.

<?php
// when the user logs in, you need to set this session variable
// this is set for 30 minutes
$y = date('Y');
$m = date('m');
$d = date('d');
$h = date('H');
$i = date('i');
$s = date('s');
$_SESSION['expireTime'] = date('YmdHis', mktime($h, $i + 30, $s, $m, $d, $y));
?>
Now, at the top of every page (below the starting of the session) that you want secure, you need to use the following for redirection and session destroying.

<?php
// get the expire time and compare
$expireTime = $_SESSION['expireTime'];
$currentTime = date('YmdHis');
if($currentTime > $expireTime){
// now we know that the time is past expiration
session_destroy();
header('Location: login.php');
exit;
}
?>

[chramya]

Hi,
i updated my code like u said.. But am getting "undefined index:expire time" error........

This is my code... IS this right..... or i have to do any corrections...


<?php

session_start();
// get the expire time and compare
$expireTime = $_SESSION['expireTime'];
$currentTime = date('YmdHis');
if($currentTime > $expireTime){
// now we know that the time is past expiration
session_destroy();
header('Location: main.php');
exit;
}


$conn=odbc_connect('validate','','');
if (!$conn)
{exit("Connection Failed: " . $conn);}

$email=$_POST['email'];

$mypassword=$_POST['mypassword'];


$sql="SELECT * FROM user1 WHERE email='$email' and password='$mypassword' ";

$rs=odbc_exec($conn,$sql);
$count=odbc_num_rows($rs);
if($count==1)
{
session_register("email");
session_register("mypassword");
echo "Login success";
}
else
{
header("location:main.php");
}
odbc_close($conn);
?>
<?php
$y = date('Y');
$m = date('m');
$d = date('d');
$h = date('H');
$i = date('i');
$s = date('s');
$_SESSION['expireTime'] = date('YmdHis', mktime($h, $i + 30, $s, $m, $d, $y));
?>

Thanks,

[PeejAvery]

It is giving you that error because the variable has not yet been set. You can do a couple of things. The easiest way is to just put a @ in front of the variable.

$expireTime = @$_SESSION['expireTime'];
Second, you want to call the first bit of code I provided ONLY at the login.

if($count==1)
{
session_register("email");
session_register("mypassword");
echo "Login success";

$y = date('Y');
$m = date('m');
$d = date('d');
$h = date('H');
$i = date('i');
$s = date('s');
$_SESSION['expireTime'] = date('YmdHis', mktime($h, $i + 30, $s, $m, $d, $y));
}

[chramya]

Hi,

I did as u said..... but it doesnt goes apart from destroy part.... After login it simple redirects it to login page once again... wat to do to get clear result..

Thanks,

[PeejAvery]

Don't use session_register. Use $_SESSION['variablename'].

I will have to look more tomorrow morning. I need sleep.

[PeejAvery]

Okay, here is a revised version of your code. Please remember to use code or PHP tags (http://www.codeguru.com/forum/misc.php?do=bbcode) when posting. I would also suggest indenting your code for organization purposes.

I fixed the $expireTime variable with ternary logic setting it accordingly so that the session won't be destroyed constantly. I also put and isset() statement so that the authentication only happens when it is finding a POST variable.

<?php
session_start();
// get the expire time and compare
$currentTime = date('YmdHis');
$expireTime = (isset($_SESSION['expireTime'])) ? $_SESSION['expireTime'] : $currentTime;
if($currentTime > $expireTime){
// now we know that the time is past expiration
session_destroy();
header('Location: main.php');
exit;
}

if(isset($_POST['email'])){
$conn = odbc_connect('validate', '', '');
if(!$conn){exit('Connection Failed: ' . $conn);}

$email = $_POST['email'];
$mypassword = $_POST['mypassword'];

$sql = "SELECT * FROM user1 WHERE email = '$email' and password = '$mypassword'";

$rs = odbc_exec($conn,$sql);
$count = odbc_num_rows($rs);
if($count==1){
$y = date('Y');
$m = date('m');
$d = date('d');
$h = date('H');
$i = date('i');
$s = date('s');
$_SESSION['expireTime'] = date('YmdHis', mktime($h, $i + 30, $s, $m, $d, $y));

$_SESSION['email'] = $email;
$_SESSION['mypassword'] = $mypassword;
echo 'Login success';
}
else{
header('Location: main.php');
}
odbc_close($conn);
}
?>

[ludakot]

Just wondering why use all those single char variables for date and time when the date() function is clean enough in my opinion.

$y = date('Y');
$m = date('m');
$d = date('d');
$h = date('H');
$i = date('i');
$s = date('s');
$_SESSION['expireTime'] = date('YmdHis', mktime($h, $i + 30, $s, $m, $d, $y));

Instead use

$_SESSION['expireTime'] = date('YmdHis', mktime(date('h'), date('i') + 30, date('s'), date('m'), date('d'), date('y'));

Saves somewhat memory for variable allocation and typing effort :) unless I'm missing something.

[PeejAvery]

Just wondering why use all those single char variables for date and time when the date() function is clean enough in my opinion.

...

Saves somewhat memory for variable allocation and typing effort :) unless I'm missing something.
Yes, that is true. That is just habit for me. Because the web apps that I write, I use those date variables ($y, $m, $d, $h, $i, $s) throughout my code. So instead of setting them multiple times, I just set them at the beginning once and for all.

EDIT: Plus, I would rather have more lines of code with shorter line length. It is easier for reading.

[chramya]

I update my code as u said.... After 5 min of ideal time if refresh the page means then only it gets redirected.... To make it redirect automatically wat i have to do....

thanks,,

[PeejAvery]

What does it matter if it redirects right away after 5 minutes or when the user tries to see a new page? Honestly, I see that extra step as a waste of time. And it will take you a little while to code.

Either way, the only way to do that is to use AJAX. You will have to use JavaScript to create a timer to send an AJAX request to the server. Then that server-side script will check the refresh times and send back the client whether or not to refresh. The user can easily disable JavaScript to keep this from happening.

[chramya]

It redirects when the user refresh the page.... But i wants it to redirect automatically if the user doesn`t touch that page.....

[PeejAvery]

Read my last post.