Re: native vs. phplib sessions

The major bugs I see in php native sessions are: 1/ the native version uses the /tmp dir for sessions, which I believe is fairly public and insecure. 2/ If you use a directory in your own account, if it's 2 more below some level, I forget which, garbage collection no longer occurs. also, the contents are still accessible via a browser, unless safe mode is set up, and that is a lot of headache as well. 3/ the native functions garbage collect at the wrong time, i.e. AFTER the session is started, not before. 4/ I you use custom handlers, you MUST save some value in the session, (and not an empty variable) in order to have a session, unlike using the fully native handlers. 5/ You can't destroy a session with a custom handler without having to recall session_set_save_handler() a second time again, PHP stupidly kills the session handler when you destroy the session. 6/ Custom session handlers may truncate session string data. (It might be the user who commented on it's fault, depending on the field with in his database) All the above are referenced from: http://www.php.net/manual/en/ref.session.php http://www.php.net/manual/en/function.session-set-save-handler.php