Re: Re[2]: [PEAR] session cross between users?

On Thu, 18 Nov 2004 14:04:32 -0500, Erik Heerlein <erik@erikheerlein.com> wrote: > That IP validation may be a problem if the user is on a AOL account as > an AOL users IP can change on the fly. > Are you absolutely sure of that? Dial-up users' IPs can change between dial-ups, but I doubt they're going to change on-the-fly. If they did, the internet simply wouldn't work. Unless, of course, they're using some kind of round-robin proxy system, but usually a user gets directed to one and stays there for the entire session. > > > On Nov 18, 2004, at 1:22 PM, Justin Patrin wrote: > > > Well then...I would suggest adding IP validation to your sessions. Do > > something like this at the start of your script: > > > > session_start(); > > if (isset($_SESSION['userIp'])) { > > if ($_SESSION['userIp'] != $_SERVER['REMOTE_ADDR']) { > > session_destroy(); > > header('Location: > > http://www.example.com/login.php'); > > exit; > > } > > } else { > > $_SESSION['userIp'] = $_SERVER['REMOTE_ADDR']; > > } > > > > > [>] Erik Heerlein > Web Developer > > 843-762-9382 > erik@erikheerlein.com > http://www.erikheerlein.com > -- Justin Patrin