[eluser]BrianDHall[/eluser]
[quote author="garycocs" date="1254538002"]What's the deal with saving sessions in the database?? Maybe I'm getting sessions all wrong??
Thought you'd use a session to login, save the fact that's the user logged in that kinda thing??[/quote]
Well for one, in a shared virtual server environment there are garbage collection issues. I don't know if it still exists to this day, but at least in the old days someone could set their php ini directive in a script and cause the server to garbage collect across all sessions - so your customer could be in the middle of checking out and someone else's script could cause their session to be destroyed. Yikes.
If that was fixed, as well as security vulnerabilities in your users sessions being able to be viewed by other scripts on the server, the more modern reason is for easy manipulation of current session info.
For instance, lets say you want to know in your script who is logged in and browsing your site in the last 10 minutes (like a "User's Online" in a forum) - try doing that with sessions that aren't stored in the DB.
Lets say you want to run a script hourly to check on abandoned shopping carts. How do you do that with non-database sessions?
In short if you want to interact with the sessions active on your web application as a whole, and not just the session of your active user, it is much harder to do with sessions that aren't saved in the database.
Coupled with security and "survivability" issues, these are just a few reasons why saving session info in the database is rather handy.
