note 43934 added to function.session-set-save-handler

Encrypted Sessions: For those who are either sending their session data in the clear (i.e.: MySQL connections without SSL), or who have sensitive data stored in sessions (such as credit card information!) and wish to protect their users. I have placed a link to a very crude example of session data encryption for MySQL-based session handling below: http://www.cs.uchicago.edu/~ido/session_include_php.txt I apologize if the code is a bit sloppy. I might release some of my better code for this kind of thing if I have time to delete any site-specific references from that code. Donate to my college education:) http://www.cs.uchicago.edu/~ido/donate.php Motivation: While most online merchants do not store personal or credit card information in plaintext, most use standard sessions provided by PHP or other database session handlers which store session data in the clear. Most shopping cart solutions store very sensitive data in session variables. I hope I can convince more of my fellow web developers to make the minimal effort to protect privacy and confidentiality of user data by encrypting session data prior to storage. All sites developed (even in part) by me feature session data encryption, most of which feature automatic monthly regeneration of random encryption keys (and flawless auto-rollover to the new keys). In practice, you would probably want to store the symmetric key in a safer location, such as in your Apache config file as a PHP global variable. Regardless, encryption should be a minimal precaution when sensitive data (session data, for example) is sent across a network -- such as when your database and web servers are on different hosts, or when your database server is on a machine which you cannot ensure is secure. ---- Manual Page -- http://www.php.net/manual/en/function.session-set-save-handler.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+43934 Delete -- http://master.php.net/manage/user-notes.php?action=delete+43934&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+43934&report=yes Search -- http://master.php.net/manage/user-notes.php