HttpSession Wrapper Class

Question

Are there any aspects I could improve of my HttpSession wrapper class?

Other suggestions are also welcome.

namespace Http;

class HttpSession
{
    private $data;

    public function __construct($name = null, array $iniSettings = [])
    {
        if ($name) {
            session_name($name);
        }

        foreach ($iniSettings as $key => $value) {
            ini_set($key, $value);
        }
    }

    public function findParameter($name)
    {
        $this->start();

        return isset($this->data[$name]) ? $this->data[$name] : null;
    }

    public function setParameter($name, $value)
    {
        $this->start();

        $this->data[$name] = $value;
    }

    public function unsetParameter($name)
    {
        $this->start();

        unset($this->data[$name]);
    }

    public function regenerateId($deleteOldSessionFile = true)
    {
        $this->start();

        session_regenerate_id($deleteOldSessionFile);
    }

    public function destroy()
    {
        $this->start();

        $this->data = [];

        if (isset($_COOKIE[session_name()])) {
            $scParams = session_get_cookie_params();

            setcookie(
                session_name(), '', time() - 3600,
                $scParams['path'],
                $scParams['domain'],
                $scParams['secure'],
                isset($scParams['httponly'])
            );
        }

        session_destroy();
    }

    private function start()
    {
        if (isset($this->data)) {
            return null;
        }

        if (!isset($_SESSION)) {
            session_start();
        }

        $this->data = &$_SESSION;
    }
}

Answer 1

There are a few things I see:

• Work in the constructor - Don't do work in the constructor. Ideally the only things that should be in the constructor are assignments.
• DRY - Why are you repeating $this->start() all over the place?
• What's up with that destroy() method? You're doing stuff there other than destroying the session! Why?
• Your session_start() should happen once, in the constructor.
• It would be more flexible if you passed the $_SESSION array as a parameter in the constructor, rather than relying on globals.