Session Management (Oturum Yönetimi)

Session management is a crucial concept in web development that allows a web server to store information about a user across multiple page requests. The Hypertext Transfer Protocol (HTTP) is inherently stateless, meaning each request from a client to a server is treated independently, without any memory of previous interactions. Sessions provide a way to overcome this limitation by maintaining stateful information for a particular user over the course of their interaction with a website.

Why Sessions are Needed:
Imagine a user logging into a website. Without sessions, every time the user navigates to a new page, the server would forget that they are logged in, requiring re-authentication for each request. Sessions solve this by providing a mechanism to 'remember' the user's state, such as their login status, items in a shopping cart, or user preferences.

How Sessions Work:
1. Session Start: When a user first interacts with a website that uses sessions (typically initiated by calling `session_start()` in PHP), the server generates a unique Session ID.
2. ID Transmission: This Session ID is then sent back to the client's browser, usually as a small text file called a cookie. Alternatively, it can be passed via URL parameters, though cookies are the more common and secure method.
3. Server-Side Storage: The server associates this Session ID with a block of data storage (e.g., a file on the server, a database entry, or in-memory cache). This is where all the session variables (like `username`, `cart_items`, etc.) are stored.
4. Subsequent Requests: On every subsequent request from the same user, the browser sends the Session ID back to the server (via the cookie).
5. Data Retrieval: The server uses this ID to retrieve the corresponding session data from its storage, making the user's specific information available to the current script.

Key Concepts and Functions in PHP:
* `session_start()`: This function must be called at the very beginning of every PHP script that needs to utilize sessions, before any output is sent to the browser. It initializes or resumes a session.
* `$_SESSION` Superglobal: This is an associative array in PHP that stores all session variables. You can add, retrieve, modify, or remove variables from this array, and their changes will persist across different pages for the duration of the session.
* Setting a variable: `$_SESSION['key'] = 'value';`
* Accessing a variable: `$variable = $_SESSION['key'];`
* `session_unset()`: This function removes all session variables from the current session. It essentially empties the `$_SESSION` superglobal array but does not destroy the session itself or the session cookie.
* `session_destroy()`: This function destroys all data registered to a session. It deletes the session file on the server (or clears the database entry) and effectively ends the session. After `session_destroy()`, the `$_SESSION` superglobal will still exist but will be empty. It's often followed by `unset($_SESSION)` to clear the superglobal in the current script execution and optionally `setcookie(session_name(), '', time() - 3600)` to clear the session cookie from the client's browser.
* `session_regenerate_id()`: This function is important for security. It assigns a new session ID to the current session and invalidates the old one. This helps prevent session fixation attacks, especially after a user logs in.

Common Use Cases:
* User Authentication: Storing a user's logged-in status and user ID.
* Shopping Carts: Maintaining a list of items a user has added to their cart.
* User Preferences: Remembering display settings or language choices.
* Temporary Data Storage: Passing data between pages without using GET/POST requests directly.

Security Considerations:
* Session Hijacking: Attackers can try to steal a user's session ID to impersonate them. Using HTTPS (SSL/TLS) encrypts communication, making it harder to intercept session IDs. Setting `HttpOnly` and `Secure` flags on session cookies further mitigates this risk.
* Session Fixation: An attacker can provide a user with a known session ID. If the user then logs in with that ID, the attacker can hijack the authenticated session. `session_regenerate_id()` should be used after a user successfully logs in to create a fresh session ID.
* Data Sensitivity: Avoid storing highly sensitive information directly in session variables. If absolutely necessary, encrypt it. Always validate and sanitize any data retrieved from sessions, just as you would with user input.

<?php
// Always start the session at the very beginning of your script,
// before any output (HTML, whitespace, etc.)
session_start();

// --- Action Handling ---
if (isset($_GET['action'])) {
    switch ($_GET['action']) {
        case 'login':
            // Simulate a user login
            $_SESSION['user_id'] = 123;
            $_SESSION['username'] = 'Alice';
            $_SESSION['is_logged_in'] = true;
            $_SESSION['cart_items'] = ['itemA', 'itemB'];
            echo '<p style="color: green;">User \'Alice\' logged in and session data set!</p>';
            break;

        case 'update_cart':
            // Simulate updating session data on another page
            if (isset($_SESSION['is_logged_in']) && $_SESSION['is_logged_in']) {
                $_SESSION['cart_items'][] = 'itemC'; // Add a new item
                $_SESSION['last_activity'] = time(); // Update activity timestamp
                echo '<p style="color: blue;">Cart updated and last activity recorded!</p>';
            } else {
                echo '<p style="color: red;">Cannot update cart: Not logged in.</p>';
            }
            break;

        case 'remove_item_b':
            // Simulate unsetting a specific session variable element
            if (isset($_SESSION['cart_items'])) {
                $key = array_search('itemB', $_SESSION['cart_items']);
                if ($key !== false) {
                    unset($_SESSION['cart_items'][$key]);
                    $_SESSION['cart_items'] = array_values($_SESSION['cart_items']); // Re-index array
                    echo '<p style="color: orange;">ItemB removed from cart!</p>';
                } else {
                    echo '<p style="color: gray;">ItemB not found in cart.</p>';
                }
            }
            break;

        case 'logout':
            // Unset all session variables
            session_unset();
            // Destroy the session (deletes the session data file on the server)
            session_destroy();
            // It's good practice to also clear the session cookie from the client side
            if (ini_get("session.use_cookies")) {
                $params = session_get_cookie_params();
                setcookie(session_name(), '', time() - 42000,
                    $params["path"], $params["domain"],
                    $params["secure"], $params["httponly"]
                );
            }
            echo '<p style="color: red;">User logged out and session destroyed!</p>';
            break;

        case 'regenerate_id':
             // Regenerate session ID for security (e.g., after login)
            session_regenerate_id(true); // Pass true to delete the old session file
            echo '<p style="color: purple;">Session ID regenerated!</p>';
            break;
    }
}

// --- Display Current Session Status ---
echo '<h1>Session Management Example</h1>';

if (isset($_SESSION['is_logged_in']) && $_SESSION['is_logged_in']) {
    echo '<h2>Welcome back, ' . htmlspecialchars($_SESSION['username']) . '!</h2>';
    echo '<p>Your User ID: ' . htmlspecialchars($_SESSION['user_id']) . '</p>';
    echo '<p>Cart Items: ' . implode(', ', array_map('htmlspecialchars', $_SESSION['cart_items'])) . '</p>';
    if (isset($_SESSION['last_activity'])) {
        echo '<p>Last Activity: ' . date('Y-m-d H:i:s', $_SESSION['last_activity']) . '</p>';
    }
    echo '<p><a href="?action=update_cart">Update Cart (Add ItemC)</a></p>';
    echo '<p><a href="?action=remove_item_b">Remove ItemB from Cart</a></p>';
    echo '<p><a href="?action=regenerate_id">Regenerate Session ID</a></p>';
    echo '<p><a href="?action=logout">Logout</a></p>';
} else {
    echo '<p>You are not logged in.</p>';
    echo '<p><a href="?action=login">Login as Alice</a></p>';
}

echo '<h3>Current $_SESSION Array:</h3>';
echo '<pre>';
print_r($_SESSION);
echo '</pre>';

echo '<h3>Current Session ID:</h3>';
echo '<p>' . session_id() . '</p>';

echo '<h3>Instructions:</h3>';
echo '<ul>';
echo '<li>Click "Login as Alice" to start a session.</li>';
echo '<li>Observe the `$_SESSION` array content.</li>';
echo '<li>Click "Update Cart" or "Remove ItemB" to modify session data and see changes persist.</li>';
echo '<li>Click "Regenerate Session ID" to see how the ID changes while data persists.</li>';
echo '<li>Click "Logout" to destroy the session.</li>';
echo '<li>Refresh the page after each action to see the state update.</li>';
echo '</ul>';

?>