What exactly is the PHP function session_module_name for?

Question

PHP Session related functions have this one: session_module_name. The documentation only says:

session_module_name — Get and/or set the current session module

Nothing about what session modules are, what options available, and when it to use.

What is the purpose of this function?

Answer 1

The session_module_name defines how sessions are stored. You can use this in conjunction with session_set_save_handler to handle sessions manually, such as if you wanted to save/load sessions from a database. A quick search shows that there are at least 3 modules

<?php
 session_module_name("files"); // ASCII files
 session_module_name("mm"); // Shared memory
 session_module_name("user"); // Custom session backend
?>

Perhaps there are more. It would be nice if the session_module_name docs entry was a bit more helpful.

Answer 2

Session modules are otherwise known as "save handlers". Those are the mechanisms used by PHP to store session data.

Besides using session_module_name(), you can also configure that through PHP7's new session_start() argument, or through php.ini. The key used in those two cases is save_handler and session.save_handler, respectively. As said, the default storage is the filesystem.

Besides the default "files" storage, individual extensions may register their own save_handlers - such as Memcache. Registered handlers can be obtained on a per-installation basis by referring to your phpinfo() output. (manual source)

Custom-made session handlers can be created by using session_set_save_handler().

Answer 3

Setting the module name to 'user' is forbidden starting from 7.2.0.

With session_set_save_handler function, you can set your own session handler, which is not hard to implement at all. You can have options, like, Memcached, Redis, Database, Filssysten (native) and change your session handler dynamically. You could save your session data in a Database for development, in Redis for Production, could have fallbacks if one doesn't work, etc. Or you could have your data encrypted in your chosen storage system.

Back to the module names, I believe 'memcacheormemcached` is a valid module name to set. And similarly, if you have the extension enabled, so is 'redis'.

However, if you implement your own session handler and call session_module_name() as a getter, then user will be returned.