note 43948 deleted from ref.session by tomsommer

Note Submitter: ---- In case you ever wonder, "What's to stop a hacker from sending, e.g., <pre> <input type=hidden name="_SESSION[allow]" value='1'> <input type=hidden name="_SESSION[user_flag]" value='admin'> </pre> to fake a log in?", I ran a test sending the above plus a couple variable as a control (to make sure I was doing it right, namely <pre> <input type=hidden name="_MESSION[allow]" value='1'> <input type=hidden name="_MESSION[user_flag]" value='admin'> </pre>) The .php script targeted by the above form's action attribute had <pre> echo "sess allow=".$_SESSION['allow']."sess flag=".$_SESSION['session_user_flag']; echo "<br>mess allow=".$_MESSION['allow']."mess flag=".$_MESSION['session_user_flag']; </pre> And the output was <pre> sess allow= sess flag= mess allow=1 mess flag=admin </pre> which shows that you can fool some of the people some of the time, but not the $_SESSIONS variable, asserting its dominance over would-be imposters as it does. Aside: the <pre> tags are above for formatting. I suggest, for the first time this year, that the php.net team specify the legal html tags on their Add Note page.