title: Handling with session cookie lifetime and log in process. PHP
body: <p>I have a login page which displays a login dialog once it has loaded. Login dialog's just a <code>JQuery</code> dialog that uses an <code>Ajax call</code>. Something like that:</p>
  
  <pre><code>$(function() {
      var _width = $.browser.msie ? 316 : 'auto';
      var loginDialog = $('#loginDialog');
  
      loginDialog.dialog({
          closeOnEscape: false,
          open: function() {
              $(this).parent().find('.ui-dialog-titlebar-close').hide();
          },
          resizable: false,
          position: 'center',
          stack: true,
          draggable: false,
          height: 'auto',
          width: _width,
          modal: true,
          buttons: {
              'submit': function() {
                  $.ajax({
                  type: 'post',
                  dataType: 'html',
                  url: '/ProjectName/Scripts/php/AccountController.php',
                  cache: false,
                  // async: false,
                  data: $('#loginForm').serialize(),
                  success: function(accessStatus) {
                      if(accessStatus === 'granted') {
                          loginDialog.dialog('close');
                      }
                  },
                  error: function(request, status, error) {
                      // handle it in a specific manner
                      alert(error);
                  }
              });
          }
      }        
  });
  </code></pre>
  
  <p>So if it's ok (on a server side) I just close the dialog.</p>
  
  <p>Then in <code>AccountController.php</code> file as for now I have something like that:</p>
  
  <pre><code>&lt;?php   
      session_start();
      if(IsAjaxRequest()) {
          if(isset($_REQUEST['username']) &amp;&amp; isset($_REQUEST['password'])) {  
              require_once('LDAPHandler.php');
  
              // credentials
              $username = $_REQUEST['username'];
              $password = $_REQUEST['password'];
              // ... more parameters
  
              // ... Fetch against AD
              if(IsInAdminRole($username, $password)) {
                  // ... establishing mysql connection &amp; setting connection options
  
                  // and then:                        
                  mysql_query(
                      'insert into accounts'. 
                      '(login, sid) values({$username}, {session_id()})'.
                      'on duplicate key update sid=values(sid)'
                  );
  
                  // write response
                  echo 'granted';
              }
          }
      }
  ?&gt;
  </code></pre>
  
  <p>What I want is to store <code>sid</code> in the related record (<code>Accounts table</code>) in database. What makes me confused:</p>
  
  <ul>
  <li>As far as I understand if user duplicates some page after a successful login server will use <strong>the same session cookie</strong>? Am I right? Unless browser is closed.</li>
  <li>How do I handle the situation with different browsers?</li>
  <li>I read that wherever I need to use a session I must call <code>session_start()</code> on the page. Won't this give a <code>sid</code> different from one that is written during login?</li>
  <li>Say if I don't want duplicates, I mean user shouldn't access the same resource several times (simultaneously), which way is the best to handle that?</li>
  <li>Also I understand that I need to use some kind of a flag (possibly field in accounts table) to say that user is <code>active</code>, cause in other way I will store only the last <code>sid</code>. Or better solution is to delete user from db once session has closed?</li>
  </ul>
  
  <p>Huge Thanks!! </p>