cookies vs. Session 1

[GIGN]

I have been told not to use session for shopping cart type purposes.
I find this confusing since Session just uses cookies anyway.

Is there something else in it's operation which provides the basis for this argument?

[bb]

 

[ToddWW]

It all depends on how many sessions you expect to have open at a given time. True, IIS will write a single Session cookie to every browser to maintain session state. However, from there, it's your decision to keep additional data in memory on the server (Session Variables) or in cookies on the visitor's computer. While cookies can free up memory on the server, I believe it slows down requests because of the round trips required to read from cookie files.

Here's the two most critical questions in determining how to maintain a shopping cart session with your visitors.

#1: How long do you want a shopping cart session to remain active if the visitor simply closes the browser window or walks away in the middle of a shopping trip.

#2: How many visitors (MAX) do you envision during that specific period of time. The time being your answer from question 1.

#3: What is it that you want to store in your session or cookie variables. If you're thinking about storing the shopping cart in either, I wouldn't recommend it. I just finished a shopping cart recently and this is what that particular individual did.

They had two tables in their database. One was for individuals user and the other was for shopping cart items cart. When a visitor would come into the site, the server would check a single cookie for a userid on the visitor's computer. If found, that relieved the visitor from identifying him/herself with the website. That was the only cookie stored on the computer. If the visitor did not have a cookie, then one was written after the visitor supplied his/her information on checkout.

The shopping cart table had a sessionID field, inventoryID field, and quantity field. As soon as the visitor placed one item in the cart, a record was appended to the table using Request.ServerVariables("HTTP_COOKIE&quot as the sessionID value. This is the IIS session ID which is unique for every visitor and although this is the value that IIS writes to the browser as the Session cookie, it does not require a round trip to get the value. We had a DELETE method in the global.asa file that removed records from the shopping cart table when an IIS session terminated or timed out. We also removed items from the shopping cart table upon checkout.

That was it. One Session variable, which in this case is the single session variable that IIS creates when a browser requests the first page from your web site. And a single cookie variable so visitors did not have to re-enter personal information every time they came to the site.

Everything else was stored in database tables.

Hope this helps.

ToddWW

 

[GIGN]

So you reckon querying the database is quicker and less hungry than getting cookies?

 

[ToddWW]

For the shopping cart items, absolutely.

ToddWW

 

[GIGN]

While you're at it I have one other problem. I am storing [at the moment] my shoping cart items in cookies by there DB primary key:
...
Sub getKeys()
Dim SplitUpArray,equalSplit
Dim count
count = 0
splitUpArray = Split(Request.Cookies,";",-1,1)

' Now split at the "=" and pick out the relevant data.

For each index In splitUpArray
keys.add count, Split(index,"=",-1,1)(0)
count = (count+1)
Next

End Sub

...

With Response
.Cookies(product_id)("quantity&quot = quantity
.Cookies(product_id)("product_name&quot = product_name
End With
Call getKeys()

This is designed simply to get keys from the cookie, So later on I can query the database - but the first time I try this it gives error:

Microsoft VBScript runtime error '800a0009'

Subscript out of range: '[number: 0]'

/shop/addToCart.asp, line 18

After that - even with just refresh, it works fine. This is just annoying, and I would like to sort it out before I refine the whole thing - perhaps incorporating db instead of Cookies.

[bb]

 

[GIGN]

Actually, forget it, I am going to take your word for it and implement the db table - I'll let you know how I get on

Thanks
BB

 

[GIGN]

Is this being picky on MS' part?


You should not use the SessionID property to generate primary key values for a database application. This is because if the Web server is restarted, some SessionID values may be the same as those generated before the server was stopped. Instead, you should use an auto-increment column data type, such as IDENTITY with Microsoft® SQL Server, or COUNTER with Microsoft® Access.

http://www.learnasp.com/iishelp/iis/misc/default.asp

Surely this is unlikely to happen - and we are deleting them on_End of session.

 

[GIGN]

I have been using it on and off all today, and I find now there is still some entries left from old sessions in my cart table - meaning my Session_OnEnd function has not been working properly.

Is there any way to test this?

 

[ToddWW]

Sure. Start a session, put a few things in the cart, then navigate to a page that has a Session.Abandon statement in it. You'll want a page like that anyways to give your users an option to bail out.

ToddWW

 

[GIGN]

I'm nearly there, but ny onEnd is still not working - I am testing it by trying to write something into Application, so I know it works, but even that does nothing.

I took all Redirect cals out, all I have in there is:


<SCRIPT RUNAT=SERVER LANGUAGE=&quot;VBSCRIPT&quot;>

Sub Session_OnStart
Response.write Session.sessionID
Application(&quot;deleted&quot = &quot;nothing - new Session&quot;
End Sub


Sub Session_OnEnd

Dim Connector,Records,SQL_DELETE

SQL_DELETE = &quot;DELETE * FROM cart WHERE session_id = &quot; & &quot;'&quot; & Session.sessionID & &quot;'&quot;
Application(&quot;deleted&quot = SQL_DELETE


End Sub


</SCRIPT>

What am I missing? onStart is working like it should.

 

[ToddWW]

I don't understand your Application(&quot;deleted&quot variable. Anyways, here's what I would do.

Sub Session_OnEnd
  Dim Conn,SQL_DELETE,strProvider

  strProvider = Your conn string or DSN

  set Conn = Server.CreateObject("ADODB.Connection")
  SQL_DELETE = "DELETE * FROM cart WHERE session_id = " & "'" & Session.sessionID  & "'"
  Conn.Open strProvider       
  Conn.Execute SQL_DELETE
  Conn.Close
  set Conn = Nothing
  
End Sub

ToddWW

 

[GIGN]

Well that was a test so I could see that the method was being called, since my delete call was not working.

I'm a dumbass - it is being overwritten by the onstart function! I'll try again.

Perhaps all objects are read only or something?

 

[ToddWW]

Yes, that could spoof your ability to test that event since you would have to start a session to read that variable..

Honest oversight Heck, I didn't catch it..

ToddWW

 

[GIGN]

Cool man, I have got it running pretty sweet, thanks for all your time, much appreciated ;-)

Not sure what was going on with global - but it's workin!

[bb]