   PHP session scope
  I can't seem to get a clear answer from PHP's helpdocs:Please confirm if the following are true/false:(1) Once session_start() is called, all sessions have global scope regardless of what page, function or other context you are in(2) You can call the session_start() on any page inside of any function, and as soon as it executes, all session vars can be setThanks   
  What I need it to do is to store a user id on log successful in. Then, on every page that the user moves to, it runs a check to see if that $_SESSION['UID'] is set.Are globals better for this kind of thing?Basically, I need to know where session_start() and session_destroy belong (either on every single page or in the LogIn() and LogOut() routines, etc.).   ;  Sessions are what you want to use. You can think of sessions as persistent global variables. By default, php stores sessions in a file (this is how they are persistent across multiple requests to the site). This depends on your platform, but usually the files are stored under /var (on my CentOS install they are under /var/lib/php/session for example). You can configure this in your php.ini file.When you call session_start(), several things happen. First, a unique id called a token is generated which is based on things that are assumed to be unique about the user making the request such as the IP address and the User Agent, plus some randomness added in. Next, a session file is mapped to that token. If the session file does not exist, it is created. If you look in the session directory you may see the file being created. For me it looks like sess_<token>. If the file does exist, its contents are read and loaded into the SESSION global array. Now those values are available to read in your script and you can add additional values to SESSION. At the end of the script, whatever is in SESSION is written back to the session file. So if you add a new variable it will be available to other scripts, if you unset a variable, it ceases to exist since it will not be written to the session file.The way this works from the browsers point of view is that the session token is passed from the server as a Set-Cookie directive in the response header. The browser will store the token and pass it back to the server as a cookie each time it makes a request. By default this is the PHPSESSID cookie. When the PHPSESSID cookie is received by the server, it will use that as the token rather than generating a new id as described in the previous paragraph. That way the same session file is accessed each time.When you call session_destroy(), the SESSION array is cleared, the corresponding session file is deleted, and the browser is instructed to delete its cookie.So hopefully you have a mental model of what is happening behind the scenes. You need to call start_session() once at the top of each script that will access SESSION since that is how the information is loaded from the session file and into the SESSION array. You only call destroy_session() when you want the session to not exist anymore, ie. when the user logs out.Sometimes seeing everything in action can help to understand what is happening. I would suggest that you experiment a bit. Create a script that just calls session_start(). Find you find your session folder and watch what happens when you access the script. Create another script that calls session_destroy() and observe what happens. Download a tool called Fiddler and look at what is passed between the browser and the server.[Edited by - CodeMunkie on May 6, 2010 10:58:39 AM]