Re: DvDanDT->Re: [PHP] Re: Session hijacking

The 'above' would make all items of $_SESSION array into variables... Errm.. $_SESSION["id"] would become $id, $_SESSION["username"] would become $username and so on... Not completely sure this'll work, but most likely as they already exist and you only change their values, so they should remain globals... Guess it's just to try.. :p The $$ is not a typo, it means the name of the new variable should be the value of the other one... $tmp="hello"; $$tmp = "world"; echo $hello; // will output 'world' -- // DvDmanDT MSN: dvdmandt@hotmail.com Mail: dvdmandt@telia.com "Ryan A" <ryan@coinpass.com> skrev i meddelandet news:004c01c396a4$8692b3b0$f081aa51@l2zcaxu7emppqh... > Hey, > Thanks for replying. > > ****************** > $_REQUEST is a great superglobal, check it out... > And at the top of the hijacked script: > > while(list($tmp1,$tmp2)=each($_SESSION)) > $$tmp1=$tmp2; > $tmp1=tmp2=NULL; > > Could work.. :p > **************** > > Can you tell me what the above does please? (am quite a newbie) and whats > the :-p for? > plus is that double dollar ($$tmp) a typo? > > Thanks, > -Ryan