title: Is it BAD to use the $_SESSION superglobal to get the current online users, and set it back to the current session data later?
body: <p>I am using a database to store my session data. I've created some functions to query through the current active sessions and return some values to be used on the current page. Getting the number of open sessions seems easy enough with a single query like 
      "SELECT SessionData FROM UserSessions"
  and return the number of rows returned by the query.</p>
  
  <p>I then wanted to determine which site users are currently "online". The session stores the UserID of the user who is viewing the website. I searched and searched and seemed to only find the session_decode function for decoding what seems to be serialized data (but unserialize doesn't work). The only problem here is, session_decode automatically populates the $_SESSION superglobal. So my question is, is it "BAD" to temporarily store the $_SESSION data, use session_decode on each user that is currently online, then reset the $_SESSION variable to the temporarily stored data?</p>
  
  <pre><code>function getLoggedInUsers() {
              //NEED SOME ERROR HANDLING AROUND DB STUFF
      $oConn = DB::connect(RF_DSN);
  
      $oPrep = $oConn-&gt;prepare("SELECT SessionData FROM UserSessions WHERE SessionData LIKE ?");
  
      $oRes = $oConn-&gt;execute($oPrep, array("%UserID%"));
  
      $aCurSession = $_SESSION; //STORE SESSION DATA TO RESET LATER
  
      $aLoggedInUsers = array();
      while ($oRow = $oRes-&gt;fetchRow(DB_FETCHMODE_ASSOC)) {
          if ($oRow == NULL) {
              break;
          }
  
          $_SESSION = array();
  
          session_decode($oRow["SessionData"]);
  
          $aLoggedInUsers[] = new User($_SESSION["UserID"]);
  
          $_SESSION = array();
      }
  
      $_SESSION = $aCurSession; //RESET SESSION DATA TO CURRENT ONLINE USER
  
      return $aLoggedInUsers;
  }
  </code></pre>
  
  <p>It seems to me that this would work, but are there any known cases where this could fail and then the current user would end up with some other user's session data, effectively being signed in as a possible admin or something? Would it be better to store another field in my UserSessions database that would house the UserID or something like that?</p>
  
  <p><em><strong></em>**EDIT***</strong>
  I am trying to display the usernames of all the current logged in users (whom have registered on the site, and logged in).</p>