note 13675 deleted from ref.session by sniper

A quick note on a feature/security threat I discovered out of neccesity: I am developing for i-mode, and for some reason when I use the POST method with sessions, the session doesn't get sent. i-mode servers do some parsing, and since the pages worked fine in IE, I thought about what to do. First I put a hidden field in the form for SID, but for some reason this didn't work either. I knew, despite some efforts on your part to hide this fact from a user, that the session ID was actually passed in a variable called PHPSESSID. I found this out by looking at the URL on my i-mode handset, which displayed the entire URL, including this. Anyway, I added the following line to my form: print ' <input type=hidden name="PHPSESSID" value="'.session_id().'">'; It works fine now, on both handset and IE. The problem as I see it is that anyone could use the PHPSESSID variable to hijack someone's session. In fact, I tried appending it to a URL of a form, with a session value from another session (one from a different IP), and it gave me their username, their password, and the ability to input data into the form. It wasn't difficult, and I am no hacker. I really want to use this feature, but I actually need it for sample code I am writing for a book, and don't want to expose a security threat. I guess adding a user's IP address to my authentication would make it fairly secure. Hmm...