Almost. The file (session) will not be deleted immediately, that is determined by session.gc_probability and session.gc_divisor.
No, the session will be expired, but the deletion of the session file is determined as stated in previous point
That is correct ordinarily, but if you were to implement your own session handler, you could alter the behavior of session expiration even in such a way that session.gc_maxlifetime is ignored
Storing session in db should not alter those rules, but could stretch them a little, if you wanted to.
edit:
This is roughly how you can register your own session handler (handler being a class) and then do whatever you want with it
First, suppose we have a class, that is going to be handling sessions for our application.
class MySession {
function open($save_path, $session_name) {
}
function close() {
}
function read($id) {
}
function write($id, $sess_data) {
}
function destroy($id) {
}
function gc($maxlifetime) {
}
}
To register the handler in php, you only need to call session_set_save_handler function, like this in our case:
// register the session handler
$sess = new MySession();
session_set_save_handler(array($sess, 'open'),
array($sess, 'close'),
array($sess, 'read'),
array($sess, 'write'),
array($sess, 'destroy'),
array($sess, 'gc'));
Note that there are actually better ways to register the handler itself, you could even do this in the constructor of your class, or in numerous other ways. But I assume that is not the point here.
What is important is the fact that although PHP gives you the needed variables corresponding to standard behavior of it's session management mechanism, you don't have to respect it (not that I would recommend that).
To answer a comment below, to ignore the maxlifetime parameter, you ignore that in your gc method and use whatever you deem necessary/right, for example (using db pseudo code):
function gc($maxlifetime) {
$sql = "DELETE * FROM MySession WHERE lastAccess < NOW()-3600";
// execute the query, say I have PDO instance in $dbh variable
$dbh->execute($sql);
}
Voila, you just completely circumvented PHP session settings by doing it by yourself.
