Comments on: Important database session limitation

By: teknoid

teknoid — Wed, 02 Feb 2011 17:37:26 +0000

@Cristiano
Whole model… or model data?
I would not recommend storing the entire object in the session. As far as any special chars, whenever information is saved into the DB cake takes special care of escaping all fields and values.

By: Cristiano

Cristiano — Wed, 02 Feb 2011 16:39:25 +0000

Consider that you are storing a whole model on the session and this model already has some html or special chars in it. Wouldn’t this break the db session in a similar way that a sql injection would do with a database?

By: teknoid

teknoid — Fri, 24 Dec 2010 22:30:19 +0000

@Michael

Remember that cake serializes the session object data. One known issue (perhaps in older versions) of PHP is that serialization can fail when certain (null or empty line) characters are stored in the session. Unfortunately I don’t have a link handy, but a little googlin’ might give more insight.

By: Michael

Michael — Fri, 24 Dec 2010 11:40:37 +0000

One benefit to store sessions in DB is using cluster for web site and two DBs with master to master replication. We’re trying to setup it. But by some reason session is stored partially. Even with LONGTEXT data field. Have no idea why.

By: seozest

seozest — Wed, 21 Jul 2010 10:58:02 +0000

Great info.Thanks for sharing
Use of sessions for DB is new for me.

By: Dan

Dan — Thu, 08 Jul 2010 05:23:57 +0000

Good to know. This is probably one of those things that I or a friend will run into at some point. Thanks for the tip.

By: teknoid

teknoid — Wed, 07 Jul 2010 22:20:45 +0000

@Mauro Zadunaisky

No problem.

Well, one benefit is that we already have proper fail-over and redundancy for our DB, and because we have multiple web servers we need a single point of storage. Prior to that we used memcache, but found it to be a little unreliable (I can’t really get into much detail, since I don’t know all the specifics). Again, we’d need to setup proper fail-over for memcache servers, which adds an extra level of maintenance and unnecessary complexity, at least for the time being.

Another benefit to using the DB is that you can further extend the session handling to “remember” users’ shopping carts, or preform additional analysis. (Since your data is in a relational DB, it makes extending base functionality a bit easier).

Performance-wise we didn’t see any difference one way or another.

By: Mauro Zadunaisky

Mauro Zadunaisky — Wed, 07 Jul 2010 22:03:17 +0000

Great tip, thank you!

Why are you using database for session storage? What’s the benefif? security? perfomance?