1

I have an intermittent error that I can't get to the bottom of.

My site has around 9000+ logins a day - I deal with all sessions in Mysql.

4 to 5 times a day I get the following block of errors appear in my php error log.

11:24:29 PHP Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, null given in C:\inetpub\wwwroot\apps\shared\sessions.php on line 43

11:24:29 PHP Warning: mysqli_real_escape_string() expects parameter 1 to be mysqli, null given in C:\inetpub\wwwroot\apps\shared\sessions.php on line 43

11:24:29 PHP Warning: mysqli_query() expects parameter 1 to be mysqli, null given in C:\inetpub\wwwroot\apps\shared\sessions.php on line 44

11:24:29 PHP Warning: mysqli_affected_rows() expects parameter 1 to be mysqli, null given in C:\inetpub\wwwroot\apps\shared\sessions.php on line 45

11:24:29 PHP Warning: mysqli_close() expects parameter 1 to be mysqli, null given in C:\inetpub\wwwroot\apps\shared\sessions.php on line 24

I cannot figure out what could be going wrong as I would have thought if it was anything major it would be happening all the time.

  <?php
    $config = array();
    $config["dbuser"] = 'myusername'; //database username
    $config["dbpass"] = 'mypassword'; //database password
    $config["database"] = 'mydatabase'; //database name
    $config["dbloc"] = '127.0.0.1'; //database location

    $dbc = NULL;        
    $garbage_timeout = 151200; // 3600 seconds = 60 minutes = 1 hour

    ini_set('session.gc_maxlifetime', $garbage_timeout);        

    function open_session() {           
        global $dbc, $config;
        $dbc = mysqli_connect($config["dbloc"], $config["dbuser"], $config["dbpass"], $config["database"]);
        return true;
    }

    function close_session() {
        global $dbc;
        return mysqli_close($dbc);  
    }

    function read_session($sid) {
        global $dbc;
        $q = "SELECT data FROM sessions WHERE id='".mysqli_real_escape_string($dbc, $sid)."'"; 
        $r = mysqli_query($dbc, $q);
        if (mysqli_num_rows($r) == 1) {
            list($data) = mysqli_fetch_array($r, MYSQLI_NUM);
            return $data;
        } else {
            return '';
        }
    }        

    function write_session($sid, $data) {
        global $dbc;
        $q = "REPLACE INTO sessions (id, data) VALUES ('".mysqli_real_escape_string($dbc, $sid)."', '".mysqli_real_escape_string($dbc, $data)."')"; 
        $r = mysqli_query($dbc, $q);
        return mysqli_affected_rows($dbc);
    }

    function destroy_session($sid) {        
        global $dbc;
        $q = "DELETE FROM sessions WHERE id='".mysqli_real_escape_string($dbc, $sid)."'"; 
        $r = mysqli_query($dbc, $q);
        $_SESSION = array();
        return mysqli_affected_rows($dbc);
    }

    function clean_session($expire) {
        global $dbc;
        $q = "DELETE FROM sessions WHERE DATE_ADD(last_accessed, INTERVAL ".(int) $expire." SECOND) < NOW()"; 
        $r = mysqli_query($dbc, $q);
        return mysqli_affected_rows($dbc);
    }        

    session_set_save_handler('open_session', 'close_session', 'read_session', 'write_session', 'destroy_session', 'clean_session');         
    ?>
ArK
  • 20,698
  • 67
  • 109
  • 136
MarkB
  • 123
  • 1
  • 7
  • 1
    You are not checking if mysqli_connect succeeds, it could be intermittently failing for some reason – Anigel Oct 31 '16 at 11:47
  • 2
    [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) – Jay Blanchard Oct 31 '16 at 12:03
  • @Anigel I tried trying to capture the error by if (!$dbc) { } but it never seems to fire... – MarkB Oct 31 '16 at 20:38

0 Answers0