note 42832 added to ref.session

You've probably all wondered at some point how secure PHP's sessions really are and what all the talk about session hijacking is. Well, though PHP does a fairly good job at keeping the session private, it can be hijacked if the PHPSESSID is known... And that's not very hard to find out, especially on busy site. The safest way is to set the session ID manually using a completely random string. I've written some code to do that for you: function randstring($length) { $count = 0; $string = ""; do { $alphaornum = rand(0, 1); if ($alphaornum == 0) $string .= chr(rand(48, 57)); else $string .= chr(rand(65, 90)); $count++; } while ($count < $length); return($string); } function login() { session_id(randstring(28)); session_start(); $_SESSION['logged_in'] = true; } That will use a completely random 28 character alphanumeric string as the session ID. The probability of 2 users getting the same ID is less than 1/(36^28) which is a very very small number.. even if the entire planet logged on to your site at the same time the likelyhood will be low :p Anyway, keep those sessions secure! ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+42832 Delete -- http://master.php.net/manage/user-notes.php?action=delete+42832&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+42832&report=yes Search -- http://master.php.net/manage/user-notes.php