note 106903 deleted from function.session-regenerate-id by danbrown

Note Submitter: development at kenzodb dot com ---- gr at gr5 dot org's tip on maintaining multiple active sessions was a great start: --------------------- // now switch to session 2... session_name('PHPSESSID_2'); if (isset($_COOKIE['phpsessid_2'])) session_id($_COOKIE['phpsessid_2']); // not doing this will simply reopen the first session again else session_id(sha1(mt_rand()); // dont use session_regenerate_id() here. Not creating a new id will create two cookies with same session id and same session variables session_start(); // ... do stuff with session 2 session_write_close(); --------------------- It's true that session_regenerate_id() would have been the wrong call. But, creating a new session ID via mt_rand() is a big step down from PHP's built-in session hash function. You can't invoke that function directly from PHP, but if you clear the existing session_id, then session_start() will generate a new ID. The only drawback is that session_start() then raises a warning ("The session id contains illegal characters"). So, call session_id(NULL) or session_id(''). One still can't make an ideal multi-session environment using PHP's built-in session handler that doesn't clobber the state of other sessions created before your own functions that you had no knowledge of, until the missing function "session_status()" makes it into a PHP release. (The problem is that there's no reliable & non-destructive way to determine whether another session is already open. session_id() will return an ID of a current session OR of a session that was already closed. session_write_close() won't tell you whether or not it actually had something to close. session_start() is the only one that gives a clue, via raising a notice "session already started," which you can trap for with a PHP error handler, but that's a destructive test, because it results in restarting the previous session if there was one, rather than leaving it closed...requiring you to immediately reclose it with session_write_close().)