Re: Effects of changing sessid information within URL

What problems (if any) would I run into if I decide to consistently compare the session id within the URL to the orginal one to rule out the possibility of someone creating a new session id for themselves. If the result of the comparison is not the same...I'd toss them an error message and force them to log back in. -----Original Message----- From: John W. Holmes <holmes072000@charter.net> To: 'dwalker' <dwalker@healthyproductsplus.com>; 'php_gen' <php-general@lists.php.net>; 'professional php' <pro_php@p2p.wrox.com> Date: Wednesday, April 16, 2003 6:28 AM Subject: RE: [PHP] Effects of changing sessid information within URL >> Will changing the sessid information within the URL have any affect >on >> the REAL session id (initially created when the user logged in)??? > >No. The file containing the data for the original session will still be >there and will be removed when garbage cleanup comes around. If the >session id is changed in the URL, that now becomes the user's session id >the next time session_start() is called. If a file matching that number >is found, then data from that file is loaded. This would be called >session hijacking. The idea is, though, that the session id is >significantly large enough that by changing it, you're not likely to >come across any other session id that's in use. > >---John W. Holmes... > >PHP Architect - A monthly magazine for PHP Professionals. Get your copy >today. http://www.phparch.com/ > > > >-- >PHP General Mailing List (http://www.php.net/) >To unsubscribe, visit: http://www.php.net/unsub.php > >