note 59914 added to ref.session

The vanilla implementation of session will blindly spew back the value of the session_id that the user sends it after URL decoding it. This can be used as an attack vector, by including strings like "%0D%0ALocation:%20http://someothersite.com/%0D%0A" in the cookie. Never trust user input, always cleanse it. If you only expect alphanumerics in the session hash, reject any session_id that doesn't contain it. <?php if(!preg_match('#^[[:alnum:]]+$#', $_COOKIE['session_id'])) { unset($_COOKIE['session_id']); } session_start(); ?> ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+59914 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+59914&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+59914&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+59914&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+59914&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+59914&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+59914&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+59914&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+59914&report=yes Search -- http://master.php.net/manage/user-notes.php