RE: [PHP] Cookie-Less Logins

This might be a bit short, but what about a constantly changing sessionid per request? Now you have a somehwat tighter security (copying cookies from user profiles is neither that difficult) Btw whats the difference between bookmarking & knowing the session id in security related terms? Bolke -----Oorspronkelijk bericht----- Van: Jeff Gannaway [mailto:webmaster@cactusgraphics.com] Verzonden: Thursday, November 23, 2000 1:17 PM Aan: php-general@lists.php.net Onderwerp: [PHP] Cookie-Less Logins Okay, I'm a little stumpe don this one. I've got a PHP3/MySQL site that users will log into so they can update their account info. Security does not have to be on-line bank/credit card tight, but I don't want to just keep passing their username and password as hidden input fields. I also don't want to use cookies. So far this is the best I've thought of.... Have a MySQL table that contains sessionid, username, and time. Pass the sesisonid from one page to another throughout the site either in hidden INPUTS or as part of an <A HREF=....> Each page will query the database to find the username and check to see if the sessionid is more than 1 day old. If it's too old, it's deleted and they have to log in again. I see 2 drawbacks to this: 1. For 24 hours, jsut knowing the sessionid enables anyone to pretend they're someone else. 2. If a client wants to bookmark a page, they'll have to re-log in whenever they go to it. Keep in mind that this is an information site, not e-commerce. Any tips out there??? Thanks, Jeff Gannaway -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net