Session.php

<?php if (!defined('BASE_PATH')) { exit('No direct script access allowed'); }

/* 
What i added:
-session_hash field md5 that gets optional user agent and/or ip to cross check against user.
-some php.ini variables

Potential further additions for this class:
-get_lock / release_lock .... apparently handy, unsure
-add flash messages functionality like codeigniter

    Database Sessions

    Requirements:
    Create the following mysql table in your database if you are
    implementing this Session Model.

    CREATE TABLE compat_sessions (
        session_id CHAR(32) NOT NULL,
        session_hash CHAR(32) NOT NULL,
        session_data TEXT NOT NULL, 
        session_lastaccesstime TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, 
        PRIMARY KEY (session_id)
    );
*/

class Session extends Model
{
    private $db;

    public function __construct()
    {
        // Instantiate new Database object
        $this->db = new Model();

        // increase cookie security
        ini_set('session.cookie_httponly', 1);
        // make sure that PHP only uses cookies for sessions and disallow session ID passing as a GET parameter
        ini_set('session.use_only_cookies', 1);

        // Additional help in preventing spoofing
        $this->securityCode = 'nSA2Cr3QgPrL';
        // Allows ::1 IP address to work
        $this->usingLocalhost = true;
        // Checks user agent / true-false
        $this->lockUserAgent = true;
        // Make sure session from same ip (bad if dynamic ip)
        $this->lockIp = false;
        #$this->lock_timeout = 60; /////////////////////////////// research... maybe add GET_LOCK, RELEASE_LOCK

        // Set handler to override SESSION
		session_set_save_handler(
            array($this, 'open'),
            array($this, 'close'),
            array($this, 'read'),
            array($this, 'write'),
            array($this, 'destroy'),
            array($this, 'gc')
        );
            
		// The following prevents unexpected effects when using objects as save handlers
        register_shutdown_function('session_write_close');

        // Set the current session id from the users browser $_COOKIE["PHPSESSID"]
        if (array_key_exists('PHPSESSID', $_COOKIE)) {
            session_id($_COOKIE['PHPSESSID']);
        } else {
            session_id($this->makeSessionId());
        }

        // This sets a persistent cookie that lasts a day.
        session_start([
            'cookie_lifetime' => 86400,
        ]);

        // Proceed to set and retrieve values by key from $_SESSION
        // $_SESSION['my_key'] = 'some value';
        // $my_value = $_SESSION['my_key'];
    }

    /*
     * Opening the Session - The first stage the session goes through
     * is the opening of the session file. Here you can perform any
     * is the opening of the session file. Here you can perform any
     * action you like; the PHP documentation indicates that this function
     * should be treated as a constructor, so you could use it to initialize
     * class variables if you’re using an OOP approach.
    */
    function open($path, $name) 
    {
        $sql = 'INSERT INTO compat_sessions SET session_id = :session_id' .
                ', session_data = :session_data, session_hash = :session_hash ON DUPLICATE KEY UPDATE session_lastaccesstime = NOW()';

        $bind = [
            ':session_id' => session_id(),
            ':session_hash' => md5(($this->lockUserAgent && isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '') . ($this->lockIp && isset($_SERVER['REMOTE_ADDR']) ? $this->getIP() : '') . $this->securityCode),
            ':session_data' => '',
        ];

        $this->db->run($sql, $bind); 

        return true;
    }

    /*
     * Immediately after the session is opened, the contents of the session
     * are read from whatever store you have nominated and placed into the $_SESSION array.
     * It is important to understand that this data is not pulled every time you access a
     * session variable. It is only pulled at the beginning of the session life cycle when
     * PHP calls the open callback and then the read callback.
    */
    function read($session_id) 
    {
        $hash = '';
        // if user agent checking true then add it to hash
        if ($this->lockUserAgent && isset($_SERVER['HTTP_USER_AGENT'])) {
            $hash .= $_SERVER['HTTP_USER_AGENT'];
        }
        // if we need to identify sessions by also checking the host
        if ($this->lockIp && isset($_SERVER['REMOTE_ADDR'])) {
            $hash .= $_SERVER['REMOTE_ADDR'];
        }
        // append this to the end
        $hash .= $this->securityCode;

        $sql = 'SELECT session_data FROM compat_sessions WHERE session_id = :session_id AND session_hash = :session_hash';

        $bind = [
            ':session_id' => $session_id,
            ':session_hash' => md5($hash),
        ];

        $data = $this->db->run($sql, $bind);

        // php 7.1 and above strictly requires the session read to return a string and not even a null value.
        if (empty($data[0]['session_data'])) {
            return '';
        } else {
            return $data[0]['session_data'];
        }
    }

    /*
     * Writing the data back to whatever store you’re using occurs either at the end of
     * the script’s execution or when you call session_write_close().
    */
    function write($session_id, $session_data) 
    { 
        $sql = 'INSERT INTO compat_sessions SET session_id = :session_id' .
                ', session_hash = :session_hash' .
                ', session_data = :session_data' .
                ', session_lastaccesstime = NOW()' .
                ' ON DUPLICATE KEY UPDATE session_data = :session_data';

        $bind = [
            ':session_id' => $session_id,
            ':session_hash' => md5(($this->lockUserAgent && isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '') . ($this->lockIp && isset($_SERVER['REMOTE_ADDR']) ? $this->getIP() : '') . $this->securityCode),
            ':session_data' => $session_data,
            ];

        $this->db->run($sql, $bind);

        return true;
    }

    /*
     * Closing the session occurs at the end of the session life cycle,
     * just after the session data has been written. No parameters are
     * passed to this callback so if you need to process something here
     * specific to the session, you can call session_id() to obtain the ID.
    */
    function close() 
    {
        $this->session_id = session_id();

        return true;
    }

    /*
     * Destroying the session manually is essential especially when using sessions
     * as a way to secure sections of your application. The callback is called when
     * the session_destroy() function is called.
     *
     * In its default session handling capability, the session_destroy() function will
     * clear the $_SESSION array of all data. The documentation on php.net states that
     * any global variables or cookies (if they are used) will not cleared, so if you
     * are using a custom session handler like this one you can perform these tasks in
     * this callback also.
    */
    function destroy($session_id) 
    {
        $sql = 'DELETE FROM compat_sessions WHERE session_id = :session_id';

        $bind = [
            ':session_id' => $session_id,
        ];
        
        $this->db->run($sql, $bind);

        $params = session_get_cookie_params();
        setcookie(session_name(), '', time() - 3600, $params['path'], $params['domain'], $params['secure'], $params['httponly']);

        return true;
    }

    /*
     * Garbage Collection - The session handler needs to cater to the fact that the
     * programmer won’t always have a chance to manually destroy session data.
     * For example, you may destroy session data when a user logs out and it is no
     * longer needed, but there’s no guarantee a user will use the logout functionality
     * to trigger the deletion. The garbage collection callback will occasionally be
     * invoked by PHP to clean out stale session data. The parameter that is passed
     * here is the max lifetime of the session which is an integer detailing the
     * number of seconds that the lifetime spans.
    */
    function gc($lifetime) 
    {
        $sql = "DELETE FROM compat_sessions WHERE session_lastaccesstime < DATE_SUB(NOW(), INTERVAL " . $lifetime . " SECOND)";
        
        $this->db->run($sql);

        return true;
    }

    /*
     * Generate a genesis Session ID.
     * Called by session->open if there is no session cookie found.
    */
    function makeSessionId()
    {
        $seed = str_split('abcdefghijklmnopqrstuvwxyz0123456789');
        $rand_id = '';
        shuffle($seed);
        foreach (array_rand($seed, 32) as $k) { // sessions ids are 32 chars in length.
            $rand_id .= $seed[$k];
        }
        return $rand_id;
    }

    /*
    * @return bool
    * Get correct user IP address.
    */
    public function getIP()
    {
        foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key)
        {
            if (array_key_exists($key, $_SERVER) === true)
            {
                foreach (array_map('trim', explode(',', $_SERVER[$key])) as $ip)
                {
                    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false) {
                        return $ip;
                    }
                    if ($this->usingLocalhost  && $ip === '::1') {
                        return $ip;
                    }
                }
            }
        }
        return false;
    }

    /*
    * Simple debugger for dumping all the Session data from the database.
    */
    public function getSessionData()
    {
        return $this->db->select('compat_sessions');
    }

}