note 64084 added to function.session-start

As for passing the session id to a pop up you may want to consider this in case of browser hijacking. on the page the pop up is launched from have <? session_start(); $_SESSION['ip']=$_SERVER['REMOTE_ADDR']; ?> window.open('popup.php?u=<?php echo session_id(); ?>', '700x500', 'toolbar=no, status=no, scrollbars=yes, location=no, menubar=no, directories=no, width=700, height=500'); and on the pop up have <? session_start(); if($_SESSION['uid']=='') { session_id(strip_tags($_GET['u'])); session_start(); if($_SESSION['ip']!==$_SERVER['REMOTE_ADDR']) { session_destroy(); echo 'HACKER!!!.. Your ip was logged and we are now going to watch you.'; exit(); } } ?> then continue on with pop up code. Hope this helps people worried about security. ---- Server IP: 216.194.113.175 Probable Submitter: 24.14.18.131 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.session-start.php Edit -- http://master.php.net/note/edit/64084 Del: integrated -- http://master.php.net/note/delete/64084/integrated Del: useless -- http://master.php.net/note/delete/64084/useless Del: bad code -- http://master.php.net/note/delete/64084/bad+code Del: spam -- http://master.php.net/note/delete/64084/spam Del: non-english -- http://master.php.net/note/delete/64084/non-english Del: in docs -- http://master.php.net/note/delete/64084/in+docs Del: other reasons-- http://master.php.net/note/delete/64084 Reject -- http://master.php.net/note/reject/64084 Search -- http://master.php.net/manage/user-notes.php