RE: [PHP4BETA] Docs for sessions?

> The session module will try to set a cookie on the client side > and, if it's not completely sure that the cookie was set, defines > a constant (sid) to contain "<session-name>=<session-id>". > > You should read about the security impacts of the so called get > mode (where you transport session IDs in the URL) in the PHPLIB > mailing list archive. Cookies have some serious advantages when > it comes to security (i.e. they are not logged, not transported > in the HTTP Referer and so on). Ah nooo.. We made the decision with our current project to reject users who have no cookie support or cookies switched off (and JavaScript 1.1+). We wont paste session IDs in the URL at all!!! What I meant was, just store the single sid in a cookie and any other relevant data in a server side database... We have a great deal of control over the target audience with this project and are stipulating IE4/NS4.5 as minimum spec browsers so no probs with Frames/cookies etc... Incidentally, on our development server (Quad PIII 500 xeon running Redhat 6.0 (Well it WAS Redhat 6.0 dist but we didn't install any RPMs.. dont like em!), Kernel 2.2.10 (with a few patches to get hardware RAID working properly), Apache 1.3.6) PHP4 installed perfectly first time.. even with MySQL installed in a non-standard directory. Looks good!! Can't use it properly till it's out of BETA of course, but that doesn't stop us playing! Regards, Matthew Clark.