Re: Re[2]: [PEAR] session cross between users?
| From: | Erik Heerlein | Date: | Thu, 18 Nov 2004 19:04:32 +0000 |
| Subject: | Re: Re[2]: [PEAR] session cross between users? | ||
| References: | 1 2 3 4 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-15650@lists.php.net to get a copy of this message | ||
That IP validation may be a problem if the user is on a AOL account as an AOL users IP can change on the fly.
On Nov 18, 2004, at 1:22 PM, Justin Patrin wrote:
Well then...I would suggest adding IP validation to your sessions. Do
something like this at the start of your script:
session_start();
if (isset($_SESSION['userIp'])) {
if ($_SESSION['userIp'] != $_SERVER['REMOTE_ADDR']) {
session_destroy();
header('Location: http://www.example.com/login.php');
exit;
}
} else {
$_SESSION['userIp'] = $_SERVER['REMOTE_ADDR'];
}
[>] Erik Heerlein
Web Developer
843-762-9382
erik@erikheerlein.com
http://www.erikheerlein.com