[PHP 4, PHP 5, PHP 7, PHP 8]
session_id — Get and/or set the current session id
Description
session_id[?string $id = null]: string|false
The
constant SID can also be used to retrieve the current name and session id as a string suitable for adding to URLs. See also Session handling.
Parameters
id If id is specified and not null, it will replace the current session id. session_id[] needs to
be called before session_start[] for that purpose. Depending on the session handler, not all characters are allowed within the session id. For example, the file session handler only allows characters in the range a-z A-Z 0-9 , [comma] and - [minus]!
Note: When using session cookies, specifying an
idfor session_id[] will always send a new cookie when session_start[] is called, regardless if the current session id is identical to the one being set.
Return Values
session_id[] returns the session id for the current session or the empty string [""] if there is no current session [no current session id
exists]. On failure, false is returned.
Changelog
| 8.0.0 | id is nullable now.
|
See Also
- session_regenerate_id[] - Update the current session id with a newly generated one
- session_start[] - Start new or resume existing session
- session_set_save_handler[] - Sets user-level session storage functions
- session.save_handler
Riikka K ¶
7 years ago
It may be good to note that PHP does not allow arbitrary session ids. The session id validation in PHP source is defined in ext/session/session.c in the function php_session_valid_key:
//github.com/php/php-src/blob/master/ext/session/session.c
To put it short, a valid session id may consists of digits, letters A to Z [both upper and lower case], comma and dash. Described as a character class, it would be [-,a-zA-Z0-9]. A valid session id may have the length between 1 and 128 characters. To validate session ids, the easiest way to do it use a function like:
session_id[] itself will happily accept invalid session ids, but if you try to start a session using an invalid id, you will get the following error:
Warning: session_start[]: The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,'
gmillikan at t1shopper dot com ¶
7 years ago
session_id[] URL-decodes the session value. For example let's say we use setcookie[] to push a cookie down to a web browser. When the browser makes the next page request the browser sends the cookie back up to us with headers like this: Cookie: PHPSESSID=enGHumY%2C-2De-F-TDzNHVmE%2ChY5;
If we use session_id[] to read the cookie it will output a value of this: enGHumY,-2De-F-TDzNHVmE,hY5
The two values don't match! Use either setrawcookie[] or URL encode if you wish to match the original value.
ab at ixo point ca ¶
11 years ago
I was perplexed by inconsistent results with the session ID depending on whether I retrieve it using SID, COOKIE, or session_id[]. I have found that session_id[] is the most reliable method, whereas SID and COOKIE["PHPSESSIONID"] are sometimes undefined.
I used this simple script to quickly test the problem on my servers:
Regardless of browser I see the COOKIE undefined on the first load and the other two defined, then SID is empty on subsequent reloads and COOKIE is defined, but session_id[] is always defined.
If I insert the session_regenerate_id[] method that jeff_zamrzla gives below the refresh the page, I get a new session_id[] but the COOKIE value is initially the prior session_id[] until I hit refresh a second time. So again, session_id[] proves to be the most reliable method.
It's probably not a bug since I found the behaviour to be consistent in PHP versions 5.2.14, 5.3.3 and 5.3.4, but I can't figure what I'm missing and hopefully this will help others who run into this.
Igor Oliveira Ferreira ¶
7 years ago
This can looks obvious, but as me, you can spend some hours to make a simple session work between different browsers and devices. These are the basics for me, but you can build upon.
ohcc at 163 dot com ¶
5 years ago
When session.use_strict_mode is set to 1 or true, you cannot use session_id[$sid] to set the session id for the current session.
Shiji Jiang ¶
7 years ago
IMPORTANT NOTE:
If you assign a specific session ID to a user in your applet, then do not run the following code either while logout,
session_regenerate_id[TRUE];
USE:
session_regenerate_id[]; instead.
OTHERWISE, setting the session id will no longer works for that user.
Anonymous ¶
15 years ago
Regarding Colin's comment, note that setting hash_bits_per_character to 5 results in characters ranging from 0-9 and a-v. Most attackers would be wise enough to realize what was going on when they saw a letter in g-v. The probability of not seeing a letter in g-v is somewhere around 2^-32.
karlhaines at comcast dot net ¶
18 years ago
Rewriting URL's is not suggested for obvious security issues. Please be careful with register_globals when using sessions! Check that all information you recieve from a user is valid before accepting it!
dmeweb at dibsplace dot com ¶
11 years ago
If you look at the notes on cookies [set_cookie I think], you will see that you can not read a cookie on the page that it is set. That is because the cookies are sent with the page request which comes, of course, before your PHP is run. You have to wait until the next page request from the same source to read the cookie.
Drugelis, Lietuva ¶
12 years ago
I had a lot of trouble with session_regenerate_id[] as it did not regenerate... Session_id[] stayed the same no matter what [unless closing the window]. I wanted to have different sid and empty vars for each session/page meeting a condition for security reasons. Finally, this worked:
Axel ¶
14 years ago
The documentation for session_id is incomplete when it says:
"For example, the file session handler only allows characters in the range a-z, A-Z and 0-9!".
It is untrue when changing the default for the session.hash_bits_per_character as Colin said. session_id may therefore contain "-" and ",".
//fr.php.net/manual/en/session.configuration.php
Francois ¶
11 years ago
In php version 5.3.2 in my case each time a new session-id was generated after session_start[] but all was working before correctly in previous versions. So I lost data from my current session [wrong session-id]. There was always a $_POST or $_GET or $_COOKIE available with the session-name and session-id, so session_start[] was taken this automatically. Now I have to execute session_id[..old id ..] before session_start[] and a session is started for the same id.
Andi, info at pragmaMx dot org ¶
19 years ago
you can also add the iframe tag:
ini_set["url_rewriter.tags", "a=href,area=href,frame=src,iframe=src,input=src,form=fakeentry"];
infinito84 at gmail dot com ¶
8 years ago
Get a shared session.
Sometimes is good can interchange messages and vars between one session and another, but PHP dont support this. I create this script that allows with session_id[] change from current session to shared session [this is, info with scope to all sessions] for read and write info and back in to user session. The code: