NYCPHP Meetup

[Hans Zaunere]

Tim Gales wrote:

> Nestor Florez wrote:
> 
>>I am trying to translate a ASP site to PHP...
> 
> 
> You are probably familiar with the following:
> http://asp2php.naken.cc/notes.php
> 
> where Michael Kohn writes:
> "Time and Date functions aren't fully supported at this time. There was a
> reason for this, but since I haven't worked on that in a while I don't
> remember why."

I'm not sure what Mr. Kohn means by this (even after reading the above URL).  PHP's time/date functions are some of the most accurate and stable (they are wrappers on the underlying C libs), especially on a UNIX system.  Granted, Windows' munge of what a date/time is may cause some confusion; but UNIX timestamps have been around longer :)

In response to Nestor's original question, the only "foolproof" method of timeing out a session is to store it outside the session data itself.  This is to say that timing out a cookie can be forged, and this is probably the method the previous ASP code uses.  The only true method for timeouts, or just about anything sent to a browser, is to record the data privately and send only an ambiguous key to the client.

H