如何检查会话是否过期或从未在php中设置

Question

How can I check if a session was ever set or was set but expired?

I am using this code and I want to make an echo if the session has expired like this: Session has expired. Please login again Session has expired. Please login again

This is my code:

session_start();
if(!isset($_SESSION['sfmlogin'])){
?>
<a href="login.php">Login again</a>
<?php
exit();
}

So for users who visit the page for the first time, they should not get an echo like session expired because they did never login before.

Answer 1

The information you are looking for is in the session meta-data - but this is not exposed via the API. The default handler uses files - so if the file exists, then there was a session. but you should not attempt to bypass the handler to get session metadata! That would be a very bad idea. Really, it sounds like you should be writing your own session handler which also exposes the metadata.

Session has expired

This is a very complicated proposition: with the default handler (leaving aside the problem of bypassing the handler to get the meta-data) there is no session expiration - there is only garbage collection of session data which hasn't been touched for some time. On some systems this is handled by a batch process. On some it is a stochastic event. So in effect, and in this context, there is no difference between an expired session and no session from the server's point of view.

You could infer from the cookies if the browser thinks it should have a session:

session_start();
if ($_COOKIE(session_name() && !count($_SESSION)) {
    print "session has expired";
    exit;
} elsif (!$_COOKIE(session_name()) {
    print "You need to login first";
    exit;
} else {
    print "welcome back....";
    ....

...but do make sure that you put something in the session when the user logs in.

Answer 2

How about doing a boolean check on session_status()? If it returns true, then the session is active, else, it would return a "Session Expired" notice. http://php.net/manual/en/function.session-status.php

Edit : You would only need to check session_status() after a user has logged in. If they have not, then the session has not been started, therefore $_SESSION would already be false and a session expiration notice wouldn't be possible.