// ----------------------------------------------------------------------
// | My Session By Marco Baldini (info [at] marcobaldini [dot] com) |
// ----------------------------------------------------------------------
// | My session is a class that stores session data in a database rather |
// | than files. This method in most secure that the default session |
// | system of PHP |
// ----------------------------------------------------------------------
// | System Requirements: A web server that support PHP (at least 4.2.0 |
// | for incoming PostreSQL support) and a DBMS up and running. If you |
// | chose MySQL you need at least MySQL 4.0.2. |
// ----------------------------------------------------------------------
// | Tested on PHP 4.3.8 and MySql 4.1.3b |
// ----------------------------------------------------------------------
// | ATTENTION: The support for PostgreSQL will be implemented in the |
// | next minor release (1.2.0). |
// ----------------------------------------------------------------------
// | This class has been created and released under the GNU GPL and is |
// | free to use and redistribute only if this whole header comments and |
// | copyright statement are not removed. Author gives no warranties. Use |
// | at your own risk. Read the copyright, change log, howto and license. |
// ----------------------------------------------------------------------
class my_session
{
var $ClassName = "session";
var $session_id;
var $connessione;
var $_MYSESSION_CONF;
var $VARS = array();
var $forced_expire;
var $versione="1.1";
var $mysql;
var $cookie;
/*
Invocazione:
require_once('config.DB_eSession.php');
require_once('class.DB_eSession.php');
$sessione = new my_session($_MYSESSION_CONF);
*/
//versione
function get_version() {
return $this->versione;
}
//registra variabili
function get_var ( $nome ) {
if(is_array(unserialize($this->VARS["$nome"])))
{
return unserialize($this->VARS["$nome"]);
}
else
{
return $this->VARS["$nome"];
}
}
//registra variabili
function register ( $nome, $valore ) {
if(is_array($valore))
{
$valore=serialize($valore);
}
if ($this->_MYSESSION_CONF['CRIPT']==1) {
$cond = "AES_ENCRYPT('".$nome."','".$this->_MYSESSION_CONF['CRIPT_KEY']."')=".$this->_MYSESSION_CONF['NOME'];
} else {
$cond = $this->_MYSESSION_CONF['NOME']."='$nome'";
}
$cond .= " AND ".$this->_MYSESSION_CONF['SID']."='".$this->session_id."'";
$this->mysql->delete ( $this->_MYSESSION_CONF['TB_NAME'], $cond );
$this->insert ( $this->_MYSESSION_CONF['TB_NAME'], $nome, $valore );
$this->get_variabili_di_sessione();
}
//deregistra variabili
function clear ( $nome ) {
if ($this->_MYSESSION_CONF['CRIPT']==1) {
$cond = "AES_ENCRYPT('".$nome."','".$this->_MYSESSION_CONF['CRIPT_KEY']."')=".$this->_MYSESSION_CONF['NOME'];
} else {
$cond = $this->_MYSESSION_CONF['NOME']."='$nome'";
}
$cond .= " AND ".$this->_MYSESSION_CONF['SID']."='".$this->session_id."'";
$this->mysql->delete ( $this->_MYSESSION_CONF['TB_NAME'], $cond );
$this->get_variabili_di_sessione();
}
//------COSTRUTTORE------------//
//costruttore PHP 4
function my_session( $mysql, $cookie ) {
$this->_construct ( $mysql, $cookie );
}
//costruttore PHP 5
function _construct ( $mysql, $cookie ) {
if ( $mysql->ClassName != "mysql" )
die ( 'Error mysql class' );
if ( $cookie->ClassName != "cookie" )
die ( 'Error cookie class' );
$this->mysql = $mysql;
$this->cookie = $cookie;
$this->sessionid();
//echo "
".$this->session_id."
";
if ($this->controllo_expire_forzato()) $this->destroy();
$this->get_variabili_di_sessione(); // ???
$_REQUEST[$this->_MYSESSION_CONF['SESSION_VAR_NAME']]=$this->session_id;
$this->cookie->send ( );
}
//---------DISTRUTTORE----------//
//distruttore PHP4
function destroy() {
$this->destruct();
}
//distruttore PHP5
function destruct() {
//elimino le variabili di sessione da DB
$cond=$this->_MYSESSION_CONF['SID']."='".$this->session_id."'";
$tabelle=$this->_MYSESSION_CONF['TB_NAME'];
$this->mysql->delete ( $this->_MYSESSION_CONF['TB_NAME'], $cond );
}
//------FUNZIONI PRIVATE-------//
function controllo_expire_forzato() {
if (time()>$this->forced_expire) return 0;
else return 1;
}
function get_variabili_di_sessione() {
$this->VARS = array();
$cond=$this->_MYSESSION_CONF['SID']."= '".$this->session_id."'";
$tabelle=$this->_MYSESSION_CONF['TB_NAME'];
//aggiorno la scadenza della sessione
$this->mysql->update ( $tabelle, array($this->_MYSESSION_CONF['EXP']), array(time()+($this->_MYSESSION_CONF['DURATA'])), $cond );
//prelevo le variabili e le metto bell'array VARS
if ($this->_MYSESSION_CONF['CRIPT']==1) {
$campi="AES_DECRYPT(".$this->_MYSESSION_CONF['VALORE'].",'".$this->_MYSESSION_CONF['CRIPT_KEY']."') as valore, AES_DECRYPT(".$this->_MYSESSION_CONF['NOME'].",'".$this->_MYSESSION_CONF['CRIPT_KEY']."') as nome";
} else {
$campi=$this->_MYSESSION_CONF['VALORE']." as valore, ".$this->_MYSESSION_CONF['NOME']." as nome";
}
$r = $this->mysql->select ( $tabelle, $campi, $cond );
foreach ( $r as $dati ) {
$this->VARS[$dati["nome"]]=$dati["valore"];
}
}
//cerco l'id della sessione, se non lo trovo lo creo nuovo
function sessionid() {
if ($this->_MYSESSION_CONF['USE_COOKIE']==true) { //cookie abilitati
//if (isset($_COOKIE[$this->_MYSESSION_CONF['SESSION_VAR_NAME']])) { // il cookie contiene qualcosa
$c = $this->cookie->_get ( $this->_MYSESSION_CONF['SESSION_VAR_NAME'] );
if (isset($c)) { // il cookie contiene qualcosa
$this->session_id=addslashes ( $c );
} else { // cerco l'ID tra i request
if (isset($_REQUEST[$this->_MYSESSION_CONF['SESSION_VAR_NAME']])) {//essite un id in request!
$this->session_id = addslashes ( $_REQUEST[$this->_MYSESSION_CONF['SESSION_VAR_NAME']] );
$this->get_variabili_di_sessione();
} else { // creo il nuovo ID e lo piazzo nel cookie
$this->new_sid();
$this->cookie->_set ( $this->_MYSESSION_CONF['SESSION_VAR_NAME'], $this->session_id );
$this->cookie->send ( );
//setcookie ($this->_MYSESSION_CONF['SESSION_VAR_NAME'], $this->session_id,time()+$this->_MYSESSION_CONF['DURATA']);
}
}
} else { //cerco altrove
if (isset($_REQUEST[$this->_MYSESSION_CONF['SESSION_VAR_NAME']])) {//esiste l'id!
$this->session_id = addslashes ( $_REQUEST[$this->_MYSESSION_CONF['SESSION_VAR_NAME']] );
$this->get_variabili_di_sessione();
} else { // creo il nuovo ID
$this->new_sid();
}
}
}
//funzione per creare un nuovo id di sessione univoco
function new_sid() {
$this->session_id=$this->genera_stringa();
while ( $this->get_num ( $this->_MYSESSION_CONF['SID'], $this->_MYSESSION_CONF['TB_NAME'], $this->session_id ) > 0 ) {
$this->session_id = $this->genera_stringa();
}
$this->forced_expire = time()+ $this->_MYSESSION_CONF['MAX_DURATA'];
}
//generero una stringa casuale
function genera_stringa()
{
$alfabeto="qazxswedcvfrtgbnhyujmklpoi0987654321";
$ris='';
for ($i=0; $i < $this->_MYSESSION_CONF['SID_LEN']; $i++) {
srand($this->make_seed());
$ris .= $alfabeto[rand(0,(strlen($alfabeto)-1))];
}
return($ris);
}
//funzione casuale per l'inizializzazione del generatore di numeri casuali
function make_seed()
{
list($usec, $sec) = explode(' ', microtime());
return (float) $sec + ((float) $usec * 100000);
}
//--------------------FUNZIONI MYSQL
//Numero dei risultati
function get_num ( $campo, $tab, $valore ) {
$query="select count(*) from $tab where $campo = '$valore'";
//echo "
$query
";
$val = $this->mysql->select_value ( $query );
return $val;
}
//insert
function insert ( $tabelle, $nome, $val ) {
if ($this->_MYSESSION_CONF['CRIPT']==1) {
$nome= "AES_ENCRYPT('".$nome."','".$this->_MYSESSION_CONF['CRIPT_KEY']."')";
$val= "AES_ENCRYPT('".$val."','".$this->_MYSESSION_CONF['CRIPT_KEY']."')";
} else {
$nome= "'".mysql_real_escape_string($nome)."'";
$val= "'".mysql_real_escape_string($val)."'";
}
$sql = "INSERT INTO $tabelle ( sid, expires, nome, valore ) VALUES ( '$this->session_id', '".(time()+$this->_MYSESSION_CONF['DURATA'])."', $nome, $val )";
$val = $this->mysql->query ( $sql );
return $val;
}
//--------------------
}
?>