note 72444 deleted from function.session-start by peehaa

Note Submitter: Devour ---- How many times you've seen this error when actually your code is perfect: Warning: session_start(): The session id contains invalid characters, valid characters are only a-z, A-Z and 0-9 in Usually there are MANY reasons why such an error can appear into your logs, page, etc. (one way to generate it, is to send PHPSESSID=''). But it wasn't our case. We checked everything, and we even logged the entire request ($_GET, $_POST) that was generating the error. Still no luck. Until one point, when we checked what the session cookie contains. It seems there are few bots that are trying to buffer overflow (?) a page, using session cookies manually changed to contain something else than session id (strlen == 32 and hex number) The bot in our case was trying to mass submit spam on pages. So we needed to check and destroy any session id that do not comply. After adding this code: $sn=session_name(); if(isset($_GET[$sn])) if(strlen($_GET[$sn])!=32) unset($_GET[$sn]); if(isset($_POST[$sn])) if(strlen($_POST[$sn])!=32) unset($_POST[$sn]); if(isset($_COOKIE[$sn])) if(strlen($_COOKIE[$sn])!=32) unset($_COOKIE[$sn]); if(isset($PHPSESSID)) if(strlen($PHPSESSID)!=32) unset($PHPSESSID); session_start(); we got rid of that. ( Note: The code is before session_start() ) Strange, kinda paranoid, but effective.