session_id() 和 session_start() 的 PHP 逻辑

PHP logic for session_id() and session_start()

提问by Jason McCreary

I inherited the following code which is interesting. The logic seems either redundant or down right wrong.

我继承了以下有趣的代码。逻辑似乎是多余的或完全错误的。

// make the use of sessions possible.
if (!session_id()) {
    session_start();
}

However, it is on a large scale subscriber system an I am reluctant to change it. Although experienced with PHP, I would appreciate the communities input to ensure I'm not missing something.

然而，它是在一个大规模的订户系统上，我不愿意改变它。尽管对 PHP 有经验，但我会感谢社区的投入，以确保我不会遗漏任何东西。

Bonus points if you can mention side-effects or insight into the current code.

如果您可以提及副作用或深入了解当前代码，则可以加分。

UPDATE

更新

Maybe logicwasn't the right word. Why check session_id()before calling session_start(), when it would always return the empty string as no where else in the code is session_start()called.

也许逻辑不是正确的词。为什么session_id()在调用之前检查session_start()，它总是返回空字符串，因为代码中没有其他地方被session_start()调用。

回答by Timur

This code is needed to check if session is already started. If session is started, no need to initialize it again. Furthermore, trying to call session_start() when session is already initialized will create E_NOTICE error.

需要此代码来检查会话是否已启动。如果会话已启动，则无需再次初始化。此外，当会话已经初始化时尝试调用 session_start() 会产生 E_NOTICE 错误。

回答by afuzzyllama

Looking at the PHP.net:
http://php.net/manual/en/function.session-id.php

望着PHP.net：
http://php.net/manual/en/function.session-id.php

session_id() returns the session id for the current session or the empty string ("") if there is no current session (no current session id exists).

session_id() 返回当前会话的会话 ID，如果没有当前会话（不存在当前会话 ID），则返回空字符串 ("")。

If you were to update the code without changing too much, it would probably be best to write:

如果您要在不进行太多更改的情况下更新代码，最好这样编写：

if (session_id() === "") {
   session_start();
}

to check to see if the session has really been started or not. If commented and referenced to the php.net doc it would be much clearer to see what the developer was trying to accomplish.

检查会话是否真的开始了。如果对 php.net 文档进行评论和引用，则可以更清楚地了解开发人员正在尝试完成的工作。

Just to note, while:

请注意，同时：

$test = ""
!$test // This returns true    

It isn't as clear.

它不是那么清楚。

回答by Smar

Especially in old code, where include files serves as functions (I've seen those) or similar solutions, single piece of code could well do few different things: initialize new session, or set new values.

特别是在旧代码中，包含文件用作函数（我见过那些）或类似的解决方案，单段代码可以很好地做一些不同的事情：初始化新会话或设置新值。

That code can be used to check if sessions are already started. After it could be for example session data validation, or something completely unrelated to sessions, but something that requires sessions to exist.

该代码可用于检查会话是否已启动。在它可能是例如会话数据验证之后，或者与会话完全无关的东西，但需要会话存在的东西。

This of course implies that programmer knew what she was doing. Most of time this kind of solutions are due programmer just copying code from old codebase, or more likely nowadays, from Google, and adjusting it until it doesn't crash, and letting it to do the job.

这当然意味着程序员知道她在做什么。大多数情况下，这种解决方案是由于程序员只是从旧代码库中复制代码，或者现在更有可能从谷歌复制代码，然后调整它直到它不会崩溃，然后让它完成工作。

The comment (in example) implies that session support is not forced; they will be instantied only if session support exist. PHP can be compiled without session support IIRC. In such case, either this is mistake by programmer or the function would always return false or null or something if session support doesn't exist.

注释（在示例中）暗示会话支持不是强制的；仅当存在会话支持时才会实例化它们。PHP 可以在没有会话支持 IIRC 的情况下编译。在这种情况下，要么这是程序员的错误，要么如果不存在会话支持，该函数将始终返回 false 或 null 或其他内容。

回答by e2-e4

I dare an answer, since I was on the way to ask the exact same question, as the above mentioned code snippet didn't initially make sense to me (either). So I wondered about why that code is found everywhere on the php.net site, and came up with a tentative answer.

我敢回答，因为我正在问完全相同的问题，因为上面提到的代码片段最初对我来说（要么）没有意义。所以我想知道为什么在 php.net 站点上到处都可以找到该代码，并想出了一个试探性的答案。

• Before... how I thought/hoped session_id()is working

• 之前......我认为/希望如何session_id()工作

session_id()returns the session ID if a session exists. So, if I'm authenticated on my site and a session has been created and filled with data, the cookie has been created and sent to the browser

session_id()如果会话存在，则返回会话 ID。因此，如果我在我的网站上通过了身份验证并且已经创建了一个会话并填充了数据，则 cookie 已经创建并发送到浏览器

session_start();
$_SESSION['uid'] = 'root';

the next page I open in the browser should have PHP see that very session I opened 10 seconds earlier from the cookie value (and internal files), right? So by running this code beforeany session_start()

我在浏览器中打开的下一个页面应该让 PHP 看到我从 cookie 值（和内部文件）提前 10 秒打开的那个会话，对吗？因此，通过在任何之前运行此代码session_start()

$sid = session_id();
if ($sid) {
   echo "Yes: no need to call session_start since ID is " . $sid;
   exit;
}

would display a Yes?

会显示 Yes？

• nope it doesn't work like that.

• 不，它不是那样工作的。

To check if a session exists, one has to call session_start()before session_id(). But, wait... if a session did not exist previously (or was expired) session_start()createsthe session. So, calling session_id()after session_start()is unlikely to return a void result, and wouldn't make much sense if one wants to check if a session exists. Does it?

要检查会话是否存在，必须调用session_start()before session_id()。但是，等等...如果会话以前不存在（或已过期），则session_start()创建会话。因此，调用session_id()aftersession_start()不太可能返回 void 结果，如果要检查会话是否存在，则没有多大意义。可以？

• Actually it does/could make sense. Depends on your programming habits.

• 实际上它确实/可能有意义。取决于你的编程习惯。

It is a bit like requireand require_once... I don't have any require_oncein my PHP programs. Because I only do the requireswhen necessary, and would be more than happy to have a Fatal errortelling me a requirewas done twice : means a bug.

这是一个有点像require和require_once......我没有任何require_once在我的PHP程序。因为我只在必要时执行需求，并且很高兴有一个致命错误告诉我一个需求被执行了两次：意味着一个错误。

Same thing with sessions : I call session_start()once at the beginning or not at all, based on context, thus it cannot be called twice (or fatal error). But I guess some people need session_id()to tell them if session_start()has already been called before in the same request. This is where session_id()makes sense...

与会话相同的事情：session_start()根据上下文，我在开始时调用一次或根本不调用，因此不能调用两次（或致命错误）。但我想有些人需要session_id()告诉他们session_start()之前是否已经在同一个请求中被调用过。这是session_id()有意义的地方......