PHP会话安全性：在数据库与更改会话中存储会话保存路径？

Question

I am trying to create a more secure PHP sessions login script. Unfortunately for this project I will be working with shared hosting. Would using PHP's session_save_path() function to change the path to something other than /tmp be a secure solution? Or do I need to save the sessions in the database?

Thanks!

Answer 1

Moving the session save path is a good start. Just make sure its not in the document root.

With some shared hosted I've observed that getting a database connection can take a second or two. Storing your sessions in the db could slow the whole app down. Your session is accessed twice per page load.

You may want to test both an see which performs better.