note 13072 deleted from function.session-start by jimw
| From: | jimw@php.net | Date: | Fri, 07 Dec 2001 20:26:47 +0000 |
| Subject: | note 13072 deleted from function.session-start by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-21910@lists.php.net to get a copy of this message | ||
<?PHP
session_start();
$id = session_id();
//$password is submitted by login form
$string = $password.$id;
$hash = md5sum($string);
session_register('hash');
?>
other pages:
-------------
session_start();
$id = session_id();
//$password is read from the database on the server
$string = $password.$id;
$local_hash = md5sum($string);
//$hash was in the session
if ($HTTP_SESSION_VARS[hash] != $local_hash)
{
//destroy the false session
session_destroy();
Header("Location: error_page.phtml");
}
?>
the code above is incorrect because he does a session_register($hash)... you need to do
session_register('hash'). While we're at it. an easy way to get around all this
'if the session doesn't exist a user can send GET variables to over-write yours'
madness is to be more restrictive on your checks. use the $HTTP_SESSION_VARS array instead of the
global variables.