Lecture 7: Dates/Times & Sessions. CS 383 Web Development II Wednesday, February 14, 2018

Transcription

1 Lecture 7: Dates/Times & Sessions CS 383 Web Development II Wednesday, February 14, 2018

2 Date/Time When working in PHP, date is primarily tracked as a UNIX timestamp, the number of seconds that have elapsed since January 1st, 1970 at 12:00am GMT 1

3 Date/Time This is why you often see bugs on webpages that: o Recently, on December 31 st, 2015, Facebook errantly sent On This Day alerts to users telling them they had been friends with somebody for 46 years, which occurred because Facebook did not track the timestamp from the very beginning that two people became friends, and incorrectly handled the case where the database listed it as 0 o Often, you may see on a website that something was posted/updated on December 31, 1969 at 7PM -- again, it is loading it as 0, and Eastern time is 5 hours behind GMT 2

4 Date/Time If there are any 32-bit machines remaining on January 19 th, 2038 (highly unlikely), we will reach the Y2K38 bug This timestamp will exceed the 31 (out of 32) bits that store the numerical value of an integer, overflow into the negative bit, and actually roll the clock back to December 13, 1901 because we would be subtracting 68 years from January 1 st, 1970, rather than add it For more information, see: 3

5 Date/Time The current UNIX timestamp can be found by calling the time() function (no arguments) Again, this will be the number of seconds that have elapsed since January 1, am Thus, suppose you want to find the timestamp for exactly five days from now you can do math to get it: time() + 60 * 60 * 24 * 5 4

6 Date/Time To get the timestamp of any other time besides the current, use: mktime([$hour[, $minute[, $second[, $month[, $day[, $year[, $is_dst]]]]]]) If any arguments are excluded, the current date/time is used for each remaining argument o If mktime(12) is called on February 17 th at 4:40:18pm, it will return the timestamp for February 17 th, 2016 at 12:40:18pm 5

7 Date/Time mktime() is also smart about carrying or borrowing (when you think about adding and subtracting from elementary school) when you do math within it s arguments For example, suppose you wanted to find the timestamp of 10 days after February 25 th (midnight): o Function call: mktime(0, 0, 0, 2, , 2016) o Although would equal February 35 th, it is smart enough to March 6 th o Likewise, mktime(0, 0, 0, , 1, 2016) will become January 1 st,

8 Date/Time To display a date/time, use the function: date($format_string[, $timestamp]) The values that can be used in the format string can be found at If the second argument is not provided, it uses the current time 7

9 Date/Time Examples (assume run at 4:45pm on Wednesday, February 17 th ): o date("f js, Y") => February 17th, 2016 o date("m/d/y") => 02/17/16 o date("g:ia") => 4:45pm If you want to add text to the string with letters that are used as codes (37/52 letters uppercase and lowercase are), use \ to escape them o date("f js, Y at g:ia") => February 17th, 2016 pm29 4:45pm o date("f js, Y \a\t g:ia") => February 17th, 2016 at 4:45pm 8

10 Sessions vs. Cookies There are two different ways to manage a user who is currently logged in and track information about a user as they go through a visit on a website: o Sessions o Cookies 9

11 Sessions vs. Cookies Pro-Session/Anti-Cookie Session data held is private to the user Any user can edit a cookie Cookies can be disabled by the user within a browser Pro Cookie/Anti-Session Cookies retain data from browser session to browser session, while sessions are lost at the end of a browser session 10

12 Example Scenario You have a website users login to, and you re trying to decide whether you want to use cookies or sessions Suppose you want to track the login with the cookie: o Can you just record the username in the cookie of who logged in? No, somebody can change it to someone else s username o Can you just record a sequential session ID? No, somebody can change it to another number o You would need to create a fairly secure, non-obvious encrypted formula to store information as a cookie so the user can t manipulate it to login as someone else If you use a session, you can just store the username in a variable, as the user can t modify the session you must do it with your script 11

13 Sessions vs. Cookies Most websites use cookies to fill in the username by default (the remember me box) of a login screen and sessions to manage everything else 12

14 Note About Setting Cookies and Sessions Cookies and sessions are both set as a part of the headers being created Headers cannot be set once something has been output to the page Thus, you cannot change cookies or sessions after something has been output to the page All cookies or sessions must be set before <!DOCTYPE html> is printed to the page 13

15 Cookies Cookies are set using: setcookie($name[, $value[, $expire[, $path[, $domain[, $secure[, $httponly]]]]]]) o $name is the variable associated with the cookie (ex: username) o $value is what $name is equal to (ex: jason.wagner1) o $expire is the UNIX timestamp of when it should expire o $path are the pages that can access the cookie (ex: if we use our websites you would want to make the path "/~username/" to ensure other users can t read your cookies) o $domain is the domain that can access it (ex: "mathcs.wilkes.edu" would allow all users to access it; "username.mathcs.wilkes.edu" would restrict access to just your subdomain) o $secure, if true, would only allow the cookie over https o $httpsonly, if true, would only allow the cookie over http 14

16 Cookies To delete a cookie, simply use the same setcookie() function calls (domain, path, etc.), but set the value to an empty string and the expire time to a time in the past, like time() 60 To access cookies in your code, simply use $_COOKIE["name"] 15

17 Sessions While sessions meet our needs better than cookies do, they are a bit more work If we are writing or just accessing sessions, we always need to first call session_start() to do anything with sessions 16

18 Sessions Think of sessions like cookies that are stored on the server These sessions must get saved somewhere The directory that sessions are stored in is traditionally owned (for read/write access) by the www-data user We can t write to that directory when our scripts run under AssignUserId 17

19 Sessions This, we must change where our sessions are held: session_save_path($path) For example: <?php session_start(); session_save_path("/var/www/html/cs383/se ssions/");?> 18

20 Sessions All of our session information is stored in $_SESSION, which we treat just like any other array $_SESSION["username"] = "jason.wagner1"; We must write any data to our session before we output anything, even whitespace or <!DOCTYPE html> To ensure the information is written before anything is output, we use the function: session_write_close() Even after calling session_write_close(), we can still access our data in the session we just can t write to it 19

21 Sessions Example: <?php session_start(); session_save_path("/var/www/html/cs383/se ssions/"); $_SESSION["username"] = $_POST["username"]; session_write_close();?> 20

22 Sessions Because users cannot see or write to the session files, we can store information in the sessions that make it easier for us to code solutions to our problems without worrying about users seeing or changing something to manipulate the session To destroy the entire session, use session_destroy() To delete one sesson variable, use unset($_session["variable"]); 21

23 Sessions Sessions have a maximum amount of time, set in php.ini, that must occur without a user session being accessed before it is erased If this setting is set to 30 minutes, even if nothing with the session is changed, as long as the user accesses a page that calls session_start(), their 30 minute timer restarts Thus, they must go that length of time without accessing a page with session_start() before the session is automatically ended 22

24 Sessions To set your own expiration time, you would code the following: o Store an expire time, calculated as you would for cookies, in a session variable o Each time you open a session, check the current time against the expire time If the current time > expire time, destroy the session/auto logout If current time < expire time, update expire time and load page as expected 23

25 Sessions Files are stored in files called sess_md5hexadecimalstring The contents of the file are the equivalent of serialize($_session) 24

26 Other Headers There are other header functions that can be set that we will cover later in this course: o File content-type o Force download of a file o Cache webpage One that may be helpful now is to automatically redirect the visitor to another page 25

27 Other Headers Redirect someone to Google.com: <?php header("location: exit();?> The call of exit() after the header call is important if the user is not redirected and something is output while it is waiting, you will get an error that the headers were already sent, or other code can be executed 26

28 Other Headers To redirect somebody to another page within your website: <?php header("location: login.php"); exit();?> For example, you can use this to check to see if a user is already logged in, and if not, redirect them to a login page 27