# User session helper class

I write this session helper class to use it inside my projects for managing the $_SESSION variables setup after an user login or logout. It's very simple and after some tests it seems to work smoothly and fine. The class doesn't have a constructor, this because the needed parameters that are the username and the user id are passed directly to the setSession method. The sessionCode method is instead only a code who is used to check if the user is logged in or not, this to limit the access to certain pages if needed. <?php namespace library; class SessionHelper{ private$username;
private $id; private$ip;

public function setSession(string $email,int$id){
session_regenerate_id();
$_SESSION['session_code'] =$this->sessionCode();
$_SESSION['user_ip'] =$_SERVER['REMOTE_ADDR'];
$_SESSION['user_id'] =$id;
$_SESSION['username'] =$email;

return true;
}

public function sessionStatus(){
if(isset($_SESSION['session_code'])){ if(hash_equals($_SESSION['session_code'], $this->sessionCode())){ return true; } else { return false; } } } public function unsetSession(){ session_unset(); session_destroy(); return true; } private function sessionCode(){ return hash('sha256', session_id()); } } ?>  USAGE EXAMPLE AFTER A LOGIN SCRIPT: <?php require_once 'SessionHelper.php'; use library\SessionHelper as SessionHelper;$session = new SessionHelper;

$session->setSession('user1', '4'); ?>  USAGE ON RESTRICTED ACCESS PAGES <?php session_start(); require_once 'library/Autoloader.php'; use library\SessionHelper as SessionHelper;$session = new SessionHelper;

if($session->sessionStatus() != true){ header('Location: index'); die(); } ?>  • What's the point of session_regenerate_id() here? I also can't see how you're using the session code in a safe manner. You must be accessing $_SESSION outside this helper class, which defeats the point of having this class. The idea behind classes is that they abstract things for you. So it shouldn't matter whether you use $_SESSION to implement this class, or something else, you can always use it in the same way. – KIKO Software Jul 3 '18 at 12:28 • the regenerate id is used to regenerate the session id after a successful login. Do you have suggestion about session code? – user9741470 Jul 3 '18 at 13:01 • I know what session_regenerate_id() does, and when you use it, but why do you need to regenerate the session id after a successful login? I don't see the point of that. No, I don't have a suggestion about the session code, but I would like to see how it's being used by you. – KIKO Software Jul 3 '18 at 14:21 • I've used it because some developers here in past have suggested me to regenerate te session id after an user login. The use of the session code will be if(!isset($_SESSION['session_code'])) ..so it will be only a check. I'm thinking to implement this control inside a class method – user9741470 Jul 3 '18 at 18:11
• Yes, I also think it should be a method inside the helper class. Given the way you use the session code it could be a simple boolean, or even a single value like 1, instead of a 8 character pseudo-random string. You're only checking its presence, not the fact that it's a complex code. A better key would then be: user_logged_in. – KIKO Software Jul 3 '18 at 19:57