note 72444 added to function.session-start

How many times you've seen this error when actually your code is perfect: Warning: session_start(): The session id contains invalid characters, valid characters are only a-z, A-Z and 0-9 in Usually there are MANY reasons why such an error can appear into your logs, page, etc. (one way to generate it, is to send PHPSESSID=''). But it wasn't our case. We checked everything, and we even logged the entire request ($_GET, $_POST) that was generating the error. Still no luck. Until one point, when we checked what the session cookie contains. It seems there are few bots that are trying to buffer overflow (?) a page, using session cookies manually changed to contain something else than session id (strlen == 32 and hex number) The bot in our case was trying to mass submit spam on pages. So we needed to check and destroy any session id that do not comply. After adding this code: $sn=session_name(); if(isset($_GET[$sn])) if(strlen($_GET[$sn])!=32) unset($_GET[$sn]); if(isset($_POST[$sn])) if(strlen($_POST[$sn])!=32) unset($_POST[$sn]); if(isset($_COOKIE[$sn])) if(strlen($_COOKIE[$sn])!=32) unset($_COOKIE[$sn]); if(isset($PHPSESSID)) if(strlen($PHPSESSID)!=32) unset($PHPSESSID); session_start(); we got rid of that. ( Note: The code is before session_start() ) Strange, kinda paranoid, but effective. ---- Server IP: 69.147.83.197 Probable Submitter: 82.76.115.71 ---- Manual Page -- http://www.php.net/manual/en/function.session-start.php Edit -- https://master.php.net/note/edit/72444 Del: integrated -- https://master.php.net/note/delete/72444/integrated Del: useless -- https://master.php.net/note/delete/72444/useless Del: bad code -- https://master.php.net/note/delete/72444/bad+code Del: spam -- https://master.php.net/note/delete/72444/spam Del: non-english -- https://master.php.net/note/delete/72444/non-english Del: in docs -- https://master.php.net/note/delete/72444/in+docs Del: other reasons-- https://master.php.net/note/delete/72444 Reject -- https://master.php.net/note/reject/72444 Search -- https://master.php.net/manage/user-notes.php