Disadvantages of storing session data in MySQL?

[eluser]Devyn[/eluser]
You left me with a lot of information and ideas. Thanks jedd

[eluser]überfuzz[/eluser]
Jedi is right. Use the storing methods I wrote about and see if you can find anyone thats able to hack it. (If you hash the info, you can store the hash in a separate sql-table. One hash to each user.)

[eluser]Devyn[/eluser]
[quote author="überfuzz" date="1253273497"]Jedi is right. Use the storing methods I wrote about and see if you can find anyone thats able to hack it. (If you hash the info, you can store the hash in a separate sql-table. One hash to each user.)[/quote] Can I store hash in session table without storing in separete table? So I can access the data with session ID. Does it make sense?

[eluser]jedd[/eluser]
[quote author="Devyn" date="1253383611"]
Can I store hash in session table without storing in separete table? So I can access the data with session ID. Does it make sense?
[/quote]

Not immediately.

Have you created, and examined the contents of, your ci_session table?

There's a session_id, of course, but what are you actually trying to achieve?

I believe you are free to add additional fields to the ci_session table - I'm sure this has been discussed previously on the forums. The session class (in the user guide) provides a template, and calls it such, for the table creation - which alludes to the option of expanding that to taste.

[eluser]Devyn[/eluser]
Thanks jedd!
I would like to explain a bit more of my game.
I'm writing a card game with multiplayer where 4 players can play like famous poker games.
I want to store the value of card that has been clicked and submitted by user. So I can calculate who wins.
Firstly, my problem is I don't know how to hide the value of the card so user cannot submit a value of the card which he doesn't have.
For example, I assigned the value of Club10 card to "C10". Following url is value of Player4's C10 card.
http://staging-colorfulcloud.aptanacloud...d16e7484f/C10
However, according to you and others, I got an idea that I can hash the value of "C10" so it'll be http://url/hash_session_id/hash_card
After that, I want to save that hash_card value in session table with related session_id.
If the user submit another hash_card, it'll be updated in session table again.
Am I flow make sense?

[eluser]jedd[/eluser]
After you assign the 10-of-clubs to a user, there's no need for that to appear (in any form) in the URL, and certainly no reason to ever accept information about what cards a user has, from the user.

Store the user's cards in their (encrypted) session, and notify them - in a very one-direction kind of way - of their hand's contents.

[eluser]Devyn[/eluser]
Thanks again jedd,
I 100% accept your way that I don't need to wait for the card if the user is already assigned with that 10-of-clubs.
It must be a dumb question but I really have no idea that how can I know/listen when user click another card?
If it needs javascript/ajax, Cloud you please give me some url/tutorial/information to apply?

I'm really appreciate your help

[eluser]jedd[/eluser]
[quote author="Devyn" date="1253399109"]
It must be a dumb question but I really have no idea that how can I know/listen when user click another card?
If it needs javascript/ajax, Cloud you please give me some url/tutorial/information to apply?
[/quote]

I've never coded anything like this, but as I understand it you need to store the state of a set (array) of cards. This state needs to be stored in the database. A card can be in the deck, discarded/waste, or be attached to a given user. There may be sub-states (attributed to a user, but not revealed to that user yet, etc). All this can be controlled entirely from the server end, which is why I'm confused about 'c10', for example, ever needing to be shown in the URL - or worse yet, why you might want to read the URL to work out what card a user has.

I don't see that you'd need javascript at all here, other than to make it prettier. As I see it you'd display - for a given user - the cards they have, and you'd have a button/link that would pull another card from the deck (that function merely selects a random item from, and then updates accordingly, the array stored in the DB).

You obviously need some logic in there to ascertain winning hands / when users have gone bust / etc.

[eluser]Devyn[/eluser]
Sorry for making you confuse with my app's logic.
My game is famous classic card game called "Heart Game" which can be found in windows xp/vista's game folder.
4 players is given 13 cards initially and they play until all cards are gone.
Therefore, there is no need for generating random card on the fly.
All players are already assigned 13 cards for each and each player can see his 13 cards.
That's why I only need a way to know which card user clicked.

[eluser]jedd[/eluser]
I don't use Windows, and I don't play card games on computers.

I'll take your word for it, but you still need to a) generate your initial array of cards, b) store that between sessions (ie. database), c) track who has what cards.

You could, then, have each card's URL as a 'do this with this card' arrangement, but you'd have it check with your server's understanding of the card ownership - to ensure they were doing something with a card they were meant to have.