How can the use of databases in managing session expiration improve the overall security of PHP applications?

Using databases to manage session expiration in PHP applications can improve security by allowing for more control over session lifetimes and better tracking of active sessions. By storing session data in a database, you can easily implement features like automatic session expiration after a certain period of inactivity, as well as manually revoke sessions if necessary. This helps prevent unauthorized access to sensitive information and reduces the risk of session hijacking attacks.

// Set up database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "sessions";

$conn = new mysqli($servername, $username, $password, $dbname);

// Set session expiration time
$session_lifetime = 3600; // 1 hour

// Check session expiration
if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $session_lifetime)) {
    // Expire session
    session_unset();
    session_destroy();
}

// Update last activity time
$_SESSION['last_activity'] = time();