Er denne sessionskode ok?

Jeg har nedenstående kode til at styre sessions på min hjemmeside, men jeg er i tvivl om det er helt ok.. Jeg har bla. andet sat udløb af sessions til 4 timer. Er det også ok? Og ser koden ellers fin ud? Det lader til at det virker fint, men har selv rodet lidt med koden, så ved ikke om der er kommet "huller" eller fejl i koden;-)


<?PHP
/**
* this should not be a function, it should be a cron. It has however
* been made available so that you have a means of cleaning up unwanted
* sessions, even if you do not have access to the cron daemon or other
* scheduling mechanism.
*/
function clean_sessions()
{
    $query = "delete from loggedUsers where
                unix_timestamp(date_add(lastAccess, interval 4 hour)) < unix_timestamp(now())";
    $result = mysql_query($query);
}

/**
* returns 0 if you are not logged in. else returns your userid
* also updates the 'lastAccess' field in the logged users table.
*/
function is_logged($sid="")
{
    global $con;
   
   
    if(!isset($sid) || $sid == '')
    {
        $sid = session_id();
    }
   
    /*
    * if you set up a cron to clean up unwanted sessions, please comment
    * the next line.
    */
    clean_sessions();
    $query = "SELECT userId from loggedUsers where sessionId = '$sid' and
              unix_timestamp(date_add(lastAccess, interval 4 hour)) > unix_timestamp(now())";

    $result = mysql_query($query);
   
    if($result)
    {
        $row = mysql_fetch_row($result);
        if($row)
        {   

            $query = "UPDATE loggedUsers set lastAccess=now() where userId = $row[0]";
            mysql_query($query);
        }
       
        return $row[0];
    }
    else
    {
        return 0;
    }
}

/**
* Are you logged in as the administrator?
* also updates the 'lastAccess' field in the logged users table.
*/
function is_admin($sid="")
{
    global $con;
   
    if(!isset($sid) || $sid == '')
    {
        $sid = session_id();
    }
    clean_sessions();
    $query = "SELECT a.userId FROM loggedUsers a, users b
              WHERE a.sessionId = '$sid' AND b.userStatus >= 2 AND
              a.userId = b.userId AND
              unix_timestamp(date_add(lastAccess, interval 4 hour)) > unix_timestamp(now())";

   
    $result = mysql_query($query);
   
       
    if($result)
    {
        $row = mysql_fetch_row($result);

       
        if($row && $row[1]>1)
        {   

            $query = "UPDATE loggedUsers set lastAccess=now() where userId = $row[0]";
            mysql_query($query);
        }
        return $row[0];
    }
    else
    {
       
        return 0;
    }
}



function on_session_start($save_path, $session_name) {
    error_log($session_name . " ". session_id());

}


function on_session_end() {
    // Nothing needs to be done in this function
    // since we used persistent connection.
}

function on_session_read($key) {
    error_log($key);
    $stmt = "select session_data from sessions ";
    $stmt .= "where session_id ='$key' ";
    $stmt .= "and unix_timestamp(session_expiration) > unix_timestamp(date_add(now(),interval 4 hour))";
    $sth = mysql_query($stmt);

    if($sth)
    {
        $row = mysql_fetch_array($sth);
        return($row['session_data']);
    }
    else
    {
        return $sth;
    }
}

/**
* The heart of the session manager.
*
* If you are load balancing your web site across several servers you cannot
* store session information in files. You will either need to store the
* information in a database or use cookies. Since many people are reluctant
* to trust cookies your choices narrow down to exactly one. YOu need to use
* database.
*
* Storing session information in a database makes sense if you are on a
* shared hosting enviorenment and have concerns about security.
*
* To enabale this feature set the variable $session_in_db to 'db';
*/
function on_session_write($key, $val) {
    error_log("$key = $value");
    $val = addslashes($val);
    $insert_stmt  = "insert into sessions values('$key', ";
    $insert_stmt .= "'$val',unix_timestamp(date_add(now(), interval 4 hour)))";

    $update_stmt  = "update sessions set session_data ='$val', ";
    $update_stmt .= "session_expiration = unix_timestamp(date_add(now(), interval 4 hour))";
    $update_stmt .= "where session_id ='$key '";
   
    // First we try to insert, if that doesn't succeed, it means
    // session is already in the table and we try to update
   
   
    mysql_query($insert_stmt);
   
    $err = mysql_error();
   
    if ($err != 0)
    {
        error_log( mysql_error());
        mysql_query($update_stmt);
    }
}

function on_session_destroy($key) {
    mysql_query("delete from sessions where session_id = '$key'");
}

function on_session_gc($max_lifetime)
{
    mysql_query("delete from sessions where unix_timestamp(session_expiration) < unix_timestamp(now())");
}
   

error_log('=--------------- in session php' . $session_save . '-------------');

if($session_save == 'db')
{           
    error_log('setting save handler');
    // Set the save handlers
    session_set_save_handler("on_session_start",  "on_session_end",
                "on_session_read",    "on_session_write",
                "on_session_destroy", "on_session_gc");


}
session_start();
?>