Besides using the session manager for managing Web sessions, you can use it
to assign pseudo values to items such as product codes. This way, even though
the values are passed in plain sight, they mean little to users.This usage involves
the use and frequent replacement of nonsequential GUIDs, which I'll discuss
shortly.
How to Use the Web Session
To use the new session manager, you need to pass the GUID on every page.To do
this, append the GUID to the URL string when the next page is called in code:
<!DOCTYPE HTML PUBLIC
"-//W3C//DTD HTML 4.01
Transitional//EN"
<html>
<body>
<a href="page2.asp?
<%=guid%>">Click her
e to go to next page</a>
</body>
</html>
If you don't pass the GUID as a URL parameter on every page, the values you've
stored in the Sessvars table will be stranded from the user's session.
The URL method adds a little bit of overhead to your coding because you need
to be disciplined about reading and passing the values on every page. However,
you can use an include file for this purpose and even add it to your Web template.To
do this, you package the code in a separate file, then use the #include directive
at the top of the page's code to include the file. Using the HTML example just
given, your page's code would look like the following:
<!--#include virtual
file="/scripts/
sess_mgr.asp" -->
<!DOCTYPE HTML PUBLIC
"-//W3C//DTD HTML 4.01
Transitional//EN"
<html>
<body>
<a href="page2.asp?
<%=guid%>">Click here
to go to next page</a>
</body>
</html>
In this example, the #include directive tells the compiler to execute the code
contained in the sess_mgr.asp file before rendering the page.You should note
that the SQL Server 2000 newid() function doesn't generate sequentially ordered
GUIDs, so you can't use the GUID itself to determine when a value was added
or changed. This benefits our security scheme. However, in SQL Server 2005,
you'll find a new GUID function named newsequentialid() that does, as its name
implies, generate sequentially ordered GUIDs. The downside to sequentially ordered
GUIDs is that it's possible to guess the next GUID if you know the sequence.
For this example, you should continue to use newid() in SQL Server 2005, which
is still supported.
You'll find it becomes second nature to use the session manager on every page,
especially when you derive the concomitant benefit of tracking user-specific
inputs that will let you customize the user's interaction with your Web site
during the session. Keep in mind that the Sessvars table could quickly grow
to an unwieldy size unless managed, so you'll need to set up a job to routinely
delete old entries. For example, to delete entries more than 12 hours old, use
this stored procedure:
CREATE PROCEDURE del_sessvars
AS
DELETE FROM sessvars
WHERE DateDiff(hh,SVar_Date,Get
Date()) >= 12
If you have a high-volume site, run this stored procedure frequently, perhaps
even once per hour.You might also want to use a value less than 12 hours.This
will keep the Sessvars table small and efficient, so it produces no drag on
your page views. Also be sure to index the GUID column, as this column gets
used every time the Sessvars table is queried or updated.
Don't Assume Your System Is Secure
The session manager involves the use and frequent replacement of nonsequential
GUIDs. However, even with this method, your security might still be at risk.
For example, if you use dynamic SQL instead of stored procedures, you're providing
a road map for potential hackers, whether human or disguised as Internet bots.
Admittedly, it takes an extra step to write the stored procedure that deletes
old entries, but the extra security makes it worth doing. Don't blithely assume
yourWeb site code and database calls are secure. Also, be sure you've taken
steps to secure your SQL Server database from escalation and SQL-injection attacks.
Cookies Crumble, Web Sessions Persist
The overall advantage of passing URL strings is to persist a Web session indefinitely.
If the user opens your page on Monday, leaves the browser open, then leaves
town and comes back on Friday,the"session"will still be active. This is because
it isn't really a session at all,but a SQL Server database alternative for keeping
track of users as they navigate from page to page, without cookies and without
encountering a session timeout.
End of Article
Prev. page
1
[2]
next page -->
