note 73746 added to function.session-id

The higher you set session.hash_bits_per_character the shorter your session_id will become by using more bits per character. The possible values are 4, 5, or 6. When using sha-1 for hashing (by setting ini_set('session.hash_function', 1) the following session string lengths are produced by the three session.hash_bits_per_character settings: 4 - 40 character string 5 - 32 character string 6 - 27 character string It would seem desirable to use sha-l with 5 bits_per_character because this will emulate a standard 32 character md5 string and make a would-be attacker think that is what you're hashing with. ---- Server IP: 216.194.113.175 Probable Submitter: 71.234.177.249 ---- Manual Page -- http://www.php.net/manual/en/function.session-id.php Edit -- https://master.php.net/note/edit/73746 Del: integrated -- https://master.php.net/note/delete/73746/integrated Del: useless -- https://master.php.net/note/delete/73746/useless Del: bad code -- https://master.php.net/note/delete/73746/bad+code Del: spam -- https://master.php.net/note/delete/73746/spam Del: non-english -- https://master.php.net/note/delete/73746/non-english Del: in docs -- https://master.php.net/note/delete/73746/in+docs Del: other reasons-- https://master.php.net/note/delete/73746 Reject -- https://master.php.net/note/reject/73746 Search -- https://master.php.net/manage/user-notes.php