Elgg / Elgg

engine/classes/Elgg/Http/DatabaseSessionHandler.php

<?php
namespace Elgg\Http;

/**
 * Database session handler
 *
 * @access private
 *
 * @package    Elgg.Core
 * @subpackage Http
 */
class DatabaseSessionHandler implements \SessionHandlerInterface {

	/** @var \Elgg\Database $db */
	protected $db;

	/**
	 * Constructor
	 *
	 * @param \Elgg\Database $db The database
	 */
	public function __construct(\Elgg\Database $db) {
		$this->db = $db;
	}

	/**
	 * {@inheritDoc}
	 */
	public function open($save_path, $name) {
		return true;
	}

	/**
	 * {@inheritDoc}
	 */
	public function read($session_id) {
		
		$id = sanitize_string($session_id);

The function sanitize_string() has been deprecated: Use query parameters where possible

		$query = "SELECT * FROM {$this->db->prefix}users_sessions WHERE session='$id'";
		$result = $this->db->getDataRow($query);
		if ($result) {

The expression $result of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.

			return (string) $result->data;
		} else {
			return '';
		}
	}

	/**
	 * {@inheritDoc}
	 */
	public function write($session_id, $session_data) {
		$id = sanitize_string($session_id);

The function sanitize_string() has been deprecated: Use query parameters where possible

		$time = time();
		$sess_data_sanitised = sanitize_string($session_data);

The function sanitize_string() has been deprecated: Use query parameters where possible

		$query = "INSERT INTO {$this->db->prefix}users_sessions
			(session, ts, data) VALUES
			('$id', '$time', '$sess_data_sanitised')
			ON DUPLICATE KEY UPDATE ts = '$time', data = '$sess_data_sanitised'";

		if ($this->db->insertData($query) !== false) {
			return true;
		} else {
			return false;
		}
	}

	/**
	 * {@inheritDoc}
	 */
	public function close() {
		return true;
	}

	/**
	 * {@inheritDoc}
	 */
	public function destroy($session_id) {
		
		$id = sanitize_string($session_id);

The function sanitize_string() has been deprecated: Use query parameters where possible

		$query = "DELETE FROM {$this->db->prefix}users_sessions WHERE session='$id'";
		return (bool) $this->db->deleteData($query);
	}

	/**
	 * {@inheritDoc}
	 */
	public function gc($max_lifetime) {
		
		$life = time() - $max_lifetime;
		$query = "DELETE FROM {$this->db->prefix}users_sessions WHERE ts < '$life'";
		return (bool) $this->db->deleteData($query);
	}
}