1.2 shared_lib.php

January 22nd, 2026

1.2.1 Introduction

shared_lib.php handles all the most common and generic functionality of BEAR. It contains a number of unrelated functions in addition to the USER class and overloaded session handling functions. As a result, the bundled PHP engine will require this file on any page where sessions are used. In addition, it contains some procedural runtime code that is always executed. None of the code in this file is aware of the user interface (such as HTML).

The USER class
Functions
Environment variables

1.2.2 The USER class

The USER class takes care of all handling of user variables including session and cookies in a secure way designed to make it harder to hijack user sessions or tamper with cookie data. User session cookies are always use additional re-hashed values that change from each page to limit the amount of time a session key can be used to the duration of one page view. Cookie variables are also serialised in this way with a signature for security and with variable types preserved to simplify coding. Objects and arrays cannot be saved as cookies. The USER class exists whether the user is logged in or not. Being logged in is merely a state of the USER class. Other features such as detection of the user's language preference are also automated by the USER class.

The USER class is static and therefore does not need to be instantiated. However, to use more than the default language code property, it does need to be initialised. This also starts the PHP session.

USER::init()

Public properties

	Ver.	Static	Type	Default	Purpose
lang	1	Y	string	en	Indicates the 2 character language code that is the user's current preference. This is critical for building correct links for the user and including resources in the correct language such as form response strings

In general, there may be a large number of dynamically generated properties for a USER object which are dynamically populated depending on what information has been saved to the session.

Methods

	Ver.	Static	Arguments	Returns	Purpose
init	1	Y	(void)	(void)	Causes the USER class to effectively wake up and populate any stored session or cookie variables. Should be used instead of the PHP session_start() function. Calling this results in the session variables being reinstated to the class and all cookies within the permissible scope GLOBAL or in the current package's scope being loaded.
get_type	1	Y	(void)	string indicating the type of user	When called, this will return the type of user as one of the following codes: ANONYMOUS = a non logged in user; SYSTEM = the system user (probably a script); ADMIN = a BEAR administrator; APPLICATION = user logged in via a package
get_username	1	Y	(void)	string of the current user's username	Returns the current username for a logged in user of type ADMIN or APPLICATION.
get_email	1	Y	(void)	string of the current user's email address	Returns the current email address for a logged in user of ADMIN or APPLICATION.
save_to_client	1	Y	[key (enumeration), data (array), persistence (boolean)]	TRUE on success, otherwise FALSE	Serialises and saves data structures as cookies to the browser. The key value determines the scope of what is being saved. Two values are possible: GLOBAL = data being saved will be accessible to all packages on BEAR; ENV::$APP['session'] = the environment variable that equates to the session name defined for the current package such as "my_app". The optional data structure is an array of what to save. If not supplied, then it effectively deletes the cookie on the browser. Otherwise it is expected to be a simple array with string key names and values. The data types will be preserved. Finally, if persistence is set to TRUE, then the cookie will remain up to 1 year. Otherwise it will expire when the browser closes.
logout	1	Y	(void)	(void)	Dumps all session variables created the logged in state and sets the user type back to ANONYMOUS.
save	1	Y	key (string), data (mixed)	(void)	Serialises and saves whatever data is in the data structure to the key specified in the $_SESSION['USER'] array and makes it available via the USER class.
delete	1	Y	key (string)	(void)	Removes the data specified by the key from both the $_SESSION['USER'] array and the USER class. The key still exists but the value is set to null.
RBAC	1	Y	role name (string)	TRUE if authorised, otherwise FALSE	Tests whether the user has the supplied role name in their RBAC profile. If not, the method returns FALSE but it is up to the developer to decide how to handle this.
admin_login	1	Y	-	-	Not intended for third party use.

1.2.3 Functions

	Ver.	Arguments	Returns	Purpose
log_event	1	application ID (string), event number (int)[,objects (mixed), filename (string), function (string)	(void)	Logs an event to the event database. The event number must already be registered in the package's events.ini file (which is located according to the application ID) which is where the event class and severity come from as well as the text. Some events allow for portions of text to be replaced which can be passed by the objects. Multiple text replacements can be supplied using an array. An optional filename and function can also be provided to further enrich the log.
get_key_32	1	(void)	string of 32 unique ASCII bytes	Generates a unique 32 byte ASCII key.
get_key_16	1	(void)	string of 16 unique ASCII bytes	Generates a unique 16 byte ASCII key.
set_form	1	form key (string)[, return (boolean), no_delay(boolean) ]	(void)	This is the only HTML aware function in shared_lib.php because it is used on nearly every page. It inserts an HTML 5 complaint hidden <input> tag that contains a unique submission key for the form. The html_filters/form_processor.php contains the matching is_submitted property for confirming form submission against this key. If the return flag is set, then it returns the value of the submission key without outputting anything. This is used by the AJAX responder.php to update the key after each submission. If the no_delay flag is set the valid time is decremented by 1 second so that a form can be instantly submitted. This is useful for allowing forms to autosubmit as soon as a page loads.
load_shared_mem	1	-	-	Not intended for third party use.
get_var	1	shared memory key (string)	mixed data of whatever type was referenced from the shared memory.	Retrieves the referenced shared memory segment as the original data type.
get_include	1	shared memory key (string)	string containing the include data (assumed HTML)	Retrieves the referenced include from shared memory and returns it as a string.
sopen	1	-	-	Not intended for third party use.
sclose	1	-	-	Not intended for third party use.
sread	1	-	-	Not intended for third party use.
swrite	1	-	-	Not intended for third party use.
sdestroy	1	-	-	Not intended for third party use.
sgc	1	-	-	Not intended for third party use.
slogin	1	session ID (string), user ID (integer)	TRUE on success, otherwise FALSE	Adds flags to the current session database to indicate the current session now belongs to a logged in user. if a package supports logins and it is necessary to see which users are currently logged in, this function should be called at login time.
trace	1	anything (mixed)[. description (string)	(void)	Writes the contents of the data structure to the /bear/web_applications/logs/trace.out file including a timestamp. If the data is an array or object, all values are recursively extracted and traced.

1.2.4 Environment Variables

When shared_lib.php is called, it also automatically sets up environment variables in the static classes ENV and DB. These classes contain variables that are consistently available on every page or script of your package.

The ENV static class

The ENV class contains no functions. It is subdivided into two arrays which contains global data which is available to all packages and an application specific array which only contains data for the current package.

ENV::$GLOBAL

	Ver.	Static	Type	Default	Purpose
path	1	Y	string	/bear/web_applications	Is the path to where BEAR is installed. This is not user configurable but could change from version to version so should always be referenced from here and not hard coded in your PHP.
cluster_mode	1	Y	string	0	Is used for reporting to applications the current cluster mode (if they need to be cluster aware). Possible values are: 0 = Not clustered; 1 = Clustered as a Slave; 2 = Clustered as a Master
salt	1	Y	string		This is a string unique to each installation which provides a degree of uniqueness to hashing algorithms (if you use it).
cookie_domain	1	Y	string	asiacomtek.com	The domain under which cookies are valid. This is probably only useful if you manipulate cookies directly instead of using the built-in USER class.

ENV::$APP

This array actually contains whatever was defined in your package for the environment variables. It only has one built-in variable.

	Ver.	Static	Type	Default	Purpose
appid	1	Y	string		The ID that identifies the current package (such as "my_app").

The DB static class

This is a class which contains references to the defined databases such as IP addresses, ports, usernames, and passwords. If you use the built-in sql.php class file, then the DB class does not need to be referenced directly.

Basic Enterprise Application Realm Documentation