note 47417 added to function.session-regenerate-id

In a previous note, php at 5mm de describes how to prevent session hijacking by ensuring that the session id provided matches the HTTP_USER_AGENT and REMOTE_ADDR fields that were present when the session id was first issued. It should be noted that HTTP_USER_AGENT is supplied by the client, and so can be easily modified by a malicious user. Also, the client IP addresses can be spoofed, although that's a bit more difficult. Care should be taken when relying on the session for authentication. ---- Manual Page -- http://www.php.net/manual/en/function.session-regenerate-id.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+47417 Delete -- http://master.php.net/manage/user-notes.php?action=delete+47417&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+47417&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+47417&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+47417&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+47417&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+47417&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+47417&report=yes Search -- http://master.php.net/manage/user-notes.php