note 8187 modified in Session handling functions by hholzgra

> This means that a user can takeover the session of another user if he > knows (or guesses) the other user's session id. (all web applications are > vulnerable to this attack). While it is true that you can take over other users' session ID's, there are several things you can do to prevent this from happening. One way is to store the remote user's IP address on the server. When you start a new session, do this: $ipaddr = $REMOTE_ADDR; session_register("ipaddr"); And when the user requests a document with sensitive data verify his/her IP address: if($ipaddr != $REMOTE_ADDR) { echo "Go away!\n"; exit; } hartmut@six.de: WARNING: this does not work if the user lives behind a proxy-farm as remote address will change if different requests are servered by different hosts in the proxy pool http://www.php.net/manual/session-handling-functions.php