note 42832 deleted from ref.session by nlopess

Note Submitter: niraj6 AT yahoo DOT com ---- You've probably all wondered at some point how secure PHP's sessions really are and what all the talk about session hijacking is. Well, though PHP does a fairly good job at keeping the session private, it can be hijacked if the PHPSESSID is known... And that's not very hard to find out, especially on busy site. The safest way is to set the session ID manually using a completely random string. I've written some code to do that for you: function randstring($length) { $count = 0; $string = ""; do { $alphaornum = rand(0, 1); if ($alphaornum == 0) $string .= chr(rand(48, 57)); else $string .= chr(rand(65, 90)); $count++; } while ($count < $length); return($string); } function login() { session_id(randstring(28)); session_start(); $_SESSION['logged_in'] = true; } That will use a completely random 28 character alphanumeric string as the session ID. The probability of 2 users getting the same ID is less than 1/(36^28) which is a very very small number.. even if the entire planet logged on to your site at the same time the likelyhood will be low :p Anyway, keep those sessions secure!