note 57530 added to ref.session

The documentation says that sessions "may" be readable by other users on the system, but since it is so trivial to do, "are readable" is a more accurate statement. For example, this will display the contents of all sessions: <?php exec("cat /tmp/sess_*", $aOutput); print_r($aOutput); ?> Note: Changing sessions to use a directory other than /tmp will be harder to find, but no more secure. ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+57530 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+57530&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+57530&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+57530&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+57530&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+57530&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+57530&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+57530&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+57530&report=yes Search -- http://master.php.net/manage/user-notes.php