Re: $_SESSION issues - possible security hole?

> Why use extract()? Try commenting it out... apart from it being If you use 'register globals' there's a good chance that a variable $rights exists because it's a key in your $_SESSION array (don't shoot me if I'm wrong, I've never worked with 'register globals'). By using extract() without the $type parameter (so with EXTR_OVERWRITE set), the $type variable is overwritten. So do try commenting it out.