Saving Session Data to a Database in CodeIgniter3

CodeIgniter natively support storing session in database. You do not need to do any changes in code, just few configuration and it will work.

Storing session data in the database will increase the security of the application. Because when you have session data in the database, every time a valid session is found in the user’s cookie, a database query is performed to match it. If the session ID does not match, then the session is destroyed. Without storing sessions in the database there is a chance of restoring old session by modifying their cookies. Because a session id is stored in a cookie, so with that ID, hacker can pretend to be someone else, because a session is identified by it’s ID.

Session IDs can never be updated, they can only be generated when a new session is created.

Remember don’t forget to load session library via autoload.php or $this->load->library('session'); before use it.

First create a database table:-

1 2 3 4 5 6 7

CREATE TABLE IF NOT EXISTS `ci_sessions` (         `id` varchar(40) NOT NULL,         `ip_address` varchar(45) NOT NULL,         `timestamp` int(10) unsigned DEFAULT 0 NOT NULL,         `data` blob NOT NULL,         KEY `ci_sessions_timestamp` (`timestamp`) );

Once you have created your database table you can enable the database option in your config.php and also specify the table name if it differ as follows:

1 2 3 4 5 6

$config['sess_driver'] = 'database'; $config['sess_cookie_name'] = 'ci_sessions'; $config['sess_expiration'] = 7200; $config['sess_save_path'] = 'ci_sessions'; //It is your table name name $config['sess_match_ip'] = FALSE; $config['sess_time_to_update'] = 300;

Once enabled, the Session class will store session data in the DB.

One more advantage of storing session data in the database is, you can sync user sessions across multiple servers on heavy load times. Normal sessions are saved to files on disk. If it is behind a load balance, it is not an easy way to sync these files across multiple servers effectively without losing sessions.