<?php
/*
  Copyright (C) 2005 Guy Antony Halse.  Distribution permitted under a
  creative commons licence (Attribution-NonCommercial-ShareAlike), see
  http://creativecommons.org/licenses/by-nc-sa/2.0/
*/
/* 
PHP include file to implement PHP sessions in MySQL.

This needs a MySQL database with the following table in it:
  CREATE TABLE sessions ( sid char(40) NOT NULL PRIMARY KEY,
  value text NOT NULL, expires int(11) NOT NULL, );
The database user specified below needs select,insert,update and delete
rights for the table.

This file should be included with auto_prepend_file or something similar so
that it's incorporated in all PHP code.  This can be done with php_value in
httpd.conf or a .htacess file, or in php.ini.

There are two differences between this library and all similar ones I could
find on the web.  Firstly, this version takes care to escape all user input
so that it isn't vulnerable to SQL injection attacks (via edited cookies). 
It also logs errors to PHP's default error logging channel when it can't
access databases, etc to help you work out what's going on.

*/

$mysql_session['user']  = 'sessionuser';       // database username
$mysql_session['pass']  = 'sessionpass';       // database password
$mysql_session['host']  = 'localhost';         // database host
$mysql_session['db']    = 'php_mysql_session'; // database name
$mysql_session['table'] = 'sessions';          // table name

/* this initialises a session by creating a database connection */
function mysql_session_open($path, $name) {
  global $mysql_session;
  $mysql_session['name'] = $name;
  $mysql_session['path'] = $path;
  $mysql_session['dbh'] = @mysql_pconnect($mysql_session['host'], $mysql_session['user'], $mysql_session['pass']);
  if (mysql_errno()) {
    error_log("mysql_pconnect: " . mysql_error());
  }
  if ($mysql_session['dbh']) {
    @mysql_selectdb($mysql_session['db'], $mysql_session['dbh']);
    if (mysql_errno($mysql_session['dbh'])) {
      error_log("mysql_selectdb: " . mysql_error($mysql_session['dbh']));
    }
    return(true);
  } else {
    return(false);
  }
}

/* irrelevent because of persistant connections */
function mysql_session_close() {
  return(true);
}

/* this reads the session data for a given SID */
function mysql_session_read($sid) {
  global $mysql_session;
  $result = @mysql_query("select value from " . $mysql_session['table'] . " where sid = '" . mysql_real_escape_string($sid, $mysql_session['dbh']) . "' and expires > '" . time() . "'", $mysql_session['dbh']);
  if (mysql_errno($mysql_session['dbh'])) {
    error_log("mysql_session_read: " . mysql_error($mysql_session['dbh']));
  }
  if ($result) {
    $this = mysql_fetch_row($result);
    return($this[0]);
  } else {
    return("");
  }
}

/* this writes new session data for a given SID - will create if necessary */
function mysql_session_write($sid, $data) {
  global $mysql_session;
  $result = @mysql_query("replace into " . $mysql_session['table'] . " set sid='" . mysql_real_escape_string($sid, $mysql_session['dbh']) . "', value='" . mysql_real_escape_string($data, $mysql_session['dbh']) . "', expires='" . (time() + get_cfg_var("session.gc_maxlifetime")) . "'", $mysql_session['dbh']);
  if (mysql_errno($mysql_session['dbh'])) {
    error_log("mysql_session_write: " . mysql_error($mysql_session['dbh']));
  }
  if ($result) {
    return(true);
  } else {
    return(false);
  }
}

/* this deletes a session */
function mysql_session_destroy($sid) {
  global $mysql_session;
  $result = @mysql_query("delete from " . $mysql_session['table'] . " where sid='" . mysql_real_escape_string($sid, $mysql_session['dbh']) . "'", $mysql_session['dbh']);
  if (mysql_errno($mysql_session['dbh'])) {
    error_log("mysql_session_destroy: " . mysql_error($mysql_session['dbh']));
  }
  if ($result) {
    return(true);
  } else {
    return(false);
  }
}

/* this cleans up old sessions */
function mysql_session_garbage_collect($lifetime) {
  global $mysql_session;
  $result = @mysql_query("delete from " . $mysql_session['table'] . " where expires < '" . (time - get_cfg_var("session.gc_maxlifetime")) . "'", $mysql_session['dbh']);
  if (mysql_errno($mysql_session['dbh'])) {
    error_log("mysql_session_garbage_collect: " . mysql_error($mysql_session['dbh']));
  }
  return(true);
}

/* this installs our new session handler */
session_set_save_handler("mysql_session_open", "mysql_session_close", "mysql_session_read", "mysql_session_write", "mysql_session_destroy", "mysql_session_garbage_collect");

?>