note 59363 added to function.session-set-save-handler

php doesn't make any checks about PHPSESSID cookie format, it is then important to verify cookie format before making any sql request. if your read session request is : SELECT DataValue FROM sessions WHERE SessionID='$aKey' this generic cookie could succeed to access others session: PHPSESSID=1' OR SessionID LIKE '%>> for safety, you can make this verification before sql request: if (! preg_match('/^([0-9a-f]{32})$/i',$aKey)) return NULL; hope this can be helpful ---- Manual Page -- http://www.php.net/manual/en/function.session-set-save-handler.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+59363 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+59363&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+59363&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+59363&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+59363&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+59363&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+59363&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+59363&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+59363&report=yes Search -- http://master.php.net/manage/user-notes.php