note 54822 added to function.session-set-save-handler

Many people are using session_set_save_handler to store the session in a session database, which ofcourse is both valid and smart since it (could) increas security. What many people forgets, is that session ids can easily be edited by a user as he see fit (by editing a session_cookie for example*) * If you like to play around to test your site, check Add n edit Cookies extension for firefox. This might not be a big deal when saving them in a file, since the worst thing that may happen is that the user losts his session and a new one is generated. But when saving to an DB it is*. One should never trust that the server itself add slashes and escapes other vital characters. * A google search for "SQL Injection" gives 716 000 hits. Example code, none working: <?PHP function read ($session_id) { $sql = mysql_query("SELECT * FROM mysessions WHERE session_id=$session_id"); $data= mysql_fetch_array($sql); } } ?> Is obviously flawed. Since setting our session ID to "; drop mysessions; " would create serious problems. A more suitable approch would be, something in the lines of: Example code, none working: <?PHP function read ($session_id) { // ( Code by php.net ) if (get_magic_quotes_gpc()) { $session_id = stripslashes($session_id); } // Quote if not integer if (!is_numeric($session_id)) { $session_id = mysql_real_escape_string($session_id); } $sql = mysql_query("SELECT * FROM mysessions WHERE session_id=$session_id"); $fieldarray = mysql_fetch_array($sql); } } ?> I quick checked different sample codes and tutorials and none of them actually escaped session ids. That's my two cents for too night, Niklas ---- Manual Page -- http://www.php.net/manual/en/function.session-set-save-handler.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+54822 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+54822&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+54822&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+54822&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+54822&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+54822&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+54822&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+54822&report=yes Search -- http://master.php.net/manage/user-notes.php