PHP: Storing ‘objects’ inside the $_SESSION

by

I know this topic is old, but this issue keeps coming up and has not been addressed to my satisfaction:

Whether you save objects in $_SESSION, or reconstruct them whole cloth based on data stashed in hidden form fields, or re-query them from the DB each time, you are using state. HTTP is stateless (more or less; but see GET vs. PUT) but almost everything anybody cares to do with a web app requires state to be maintained somewhere. Acting as if pushing the state into nooks and crannies amounts to some kind of theoretical win is just wrong. State is state. If you use state, you lose the various technical advantages gained by being stateless. This is not something to lose sleep over unless you know in advance that you ought to be losing sleep over it.

I am especially flummoxed by the blessing received by the “double whammy” arguments put forth by Hank Gay. Is the OP building a distributed and load-balanced e-commerce system? My guess is no; and I will further posit that serializing his $User class, or whatever, will not cripple his server beyond repair. My advice: use techniques that are sensible to your application. Objects in $_SESSION are fine, subject to common sense precautions. If your app suddenly turns into something rivaling Amazon in traffic served, you will need to re-adapt. That’s life.

More Related Contents:

  1. PHP __PHP_Incomplete_Class Object with my $_SESSION data
  2. Parse error: syntax error, unexpected T_STRING in C:\wamp\www\b_php\project\login_save.php on line 14 [closed]
  3. Allow php sessions to carry over to subdomains
  4. Check if PHP session has already started
  5. PHP Fatal error: Using $this when not in object context
  6. How to use store and use session variables across pages?
  7. Understanding the “post/redirect/get” pattern
  8. Is possible to keep session even after the browser is closed?
  9. Why is PHP session_destroy() not working?
  10. Trying to get property of non-object in [duplicate]
  11. How long will my session last?
  12. PHP Session Hijacking
  13. How can I access an object attribute that starts with a number?
  14. PHP check whether property exists in object or class
  15. How to prevent PHP sessions being shared between different apache vhosts?
  16. How to set lifetime of session
  17. Is it possible to delete an object’s property in PHP?
  18. Get a PHP object property that is a number [duplicate]
  19. PHP & Sessions: Is there any way to disable PHP session locking?
  20. How to manage a single PHP5 session on multiple apache servers?
  21. How to set session timeout in Laravel?
  22. Cookies vs. sessions in PHP
  23. How to properly handle session and access token with Facebook PHP SDK 3.0?
  24. PHP Session ID changing on every request
  25. How to keep a PHP session active even if the browser is closed?
  26. Same domain, different folder PHP session
  27. laravel – Can’t get session in controller constructor
  28. How do I save PHP session data to a database instead of in the file system?
  29. How to decode a JSON String with several objects in PHP?
  30. Access object property with disallowed character in property name

Leave a Comment