note 34443 added to function.session-regenerate-id

session_regenerate_id() seems like a great function... just call it at the beginning of each script to make it much more difficult for network eavesdroppers to hijack your session. Only problem is that if you're using anything less than 4.3.3 (and the current stable version is 4.3.2) and you're using cookies, it won't work properly, and you probably won't realize it until you double-check your version number like I did, after many hours of debugging. The simple workaround is to use setcookie() after you call session_regenerate_id() to update the browser cookie. Just make sure you do so before outputting any HTML to the browser. I keep the following in a file called "sessionvars.php" that I include_once() at the beginning of every script that uses session variables: session_start(); session_regenerate_id(); if (version_compare(PHP_VERSION, '4.3.3') == -1) setcookie(session_name(), session_id()); if (!isset($_SESSION['init'])) { // Perform any variable initializations you need for the first script $_SESSION['init'] = TRUE; } Just remember to include it before any other text gets outputted to the browser. I hope this helps someone! ---- Manual Page -- http://www.php.net/manual/en/function.session-regenerate-id.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+34443 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+34443&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+34443&report=yes