note 54822 deleted from function.session-set-save-handler by cmb

Note Submitter: niklas at removethisandthedot dot bivald dot com ---- Many people are using session_set_save_handler to store the session in a session database, which ofcourse is both valid and smart since it (could) increas security. What many people forgets, is that session ids can easily be edited by a user as he see fit (by editing a session_cookie for example*) * If you like to play around to test your site, check Add n edit Cookies extension for firefox. This might not be a big deal when saving them in a file, since the worst thing that may happen is that the user losts his session and a new one is generated. But when saving to an DB it is*. One should never trust that the server itself add slashes and escapes other vital characters. * A google search for "SQL Injection" gives 716 000 hits. Example code, none working: <?PHP function read ($session_id) { $sql = mysql_query("SELECT * FROM mysessions WHERE session_id=$session_id"); $data= mysql_fetch_array($sql); } } ?> Is obviously flawed. Since setting our session ID to "; drop mysessions; " would create serious problems. A more suitable approch would be, something in the lines of: Example code, none working: <?PHP function read ($session_id) { // ( Code by php.net ) if (get_magic_quotes_gpc()) { $session_id = stripslashes($session_id); } // Quote if not integer if (!is_numeric($session_id)) { $session_id = mysql_real_escape_string($session_id); } $sql = mysql_query("SELECT * FROM mysessions WHERE session_id=$session_id"); $fieldarray = mysql_fetch_array($sql); } } ?> I quick checked different sample codes and tutorials and none of them actually escaped session ids. That's my two cents for too night, Niklas