note 69127 added to ref.session

I just went looking through the /tmp dir on a shared hosting server, and noticed all the php sessions stored there (bad idea for shared hosting). I noticed that some of these people/scripts are storing plain-text passwords in their sessions (another very bad idea). Here's a hint people: do not store ANYTHING that may present a security risk in the session data! This includes, passwords, creditcard information, etc. It is best, under ALL circumstances that a dir other than /tmp be used for session data. Btw, whomever it was that said it was no more secure to use a diff dir was wrong. The /tmp dir is a globally readable/writable dir. If you are using shared hosting, then you better be sure your session data is being saved within your home dir and NOT web-accessible. If you are a shared hosting sysadmin, you should be doing this for your users automatically... as well as any other tmp files (file uploads, etc...). ---- Server IP: 64.71.164.2 Probable Submitter: 24.126.48.25 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- https://master.php.net/note/edit/69127 Del: integrated -- https://master.php.net/note/delete/69127/integrated Del: useless -- https://master.php.net/note/delete/69127/useless Del: bad code -- https://master.php.net/note/delete/69127/bad+code Del: spam -- https://master.php.net/note/delete/69127/spam Del: non-english -- https://master.php.net/note/delete/69127/non-english Del: in docs -- https://master.php.net/note/delete/69127/in+docs Del: other reasons-- https://master.php.net/note/delete/69127 Reject -- https://master.php.net/note/reject/69127 Search -- https://master.php.net/manage/user-notes.php