RE: [PHP] PHPSESSID Handling...
| From: | John W. Holmes | Date: | Tue, 01 Apr 2003 19:58:37 +0000 |
| Subject: | RE: [PHP] PHPSESSID Handling... | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-141866@lists.php.net to get a copy of this message | ||
> I'm working on securing my application, and am running into a slight
issue
> that I cannot seem to find a fix for. If the attacker changes his
> PHPSESSID
> cookie to contain illegal characters, it causes an error on the screen
> upon
> session_start().
>
> How can I check to see if this is a valid number, and if it is not,
exit
> the
> application?
if(ereg('[^0-9a-f]',$_REQUEST['PHPSESSID']))
{ die("Error in session id"); }
---John W. Holmes...
PHP Architect - A monthly magazine for PHP Professionals. Get your copy
today. http://www.phparch.com/