Session Management in PHP4

I just submitted a bug report for php4 beta 2 in regards to session management. It allows you to put anything in the session id (assuming your php tmp dir is somewhere else), for instance: http://php.test.com/index.php?SESSIONID=../../../../tmp/test This will overwrite your /tmp/test file. Though this may not be a critical issue unless someone is running apache/etc as root (which is a bad idea to start) but it could be a potentially security problem if someone happens to have a file owned by nobody (or the user running the web program) I guess session ID's may need to have some kind of checking routines to make sure the id is valid, for instance, I can use a blank session id without it regenerating a new id, and so forth. I was looking through the documentation for session management, and other things, and noticed that session management ID's can only be stored in a temporary dir. Has anyone thought about putting it in a database, rather than files (as I'm not sure if its planned, or in the works.) I looked through the session.c code but couldnt find any other option for this, unless I overlooked something. Are there any other ways to print out the <?=SID?> variable into the url? For instance, I have lines like: <? print "<A HREF=http://www.test.com?"?><?=SID?>> test site </A> Is there a better way of doing it, like <? print "<A HREF=http://www.test.com?";=SID?> (That doesnt work). Also it does not work doing something like $test = "blahblahblah=SIDblah"; (I think I missed another way of setting them, but wanted to doublecheck.) One drawback I notice with session ID's is there's not an option (atleast not that I can see) where I can explictly specify whether to permit cookie (and get) mode, or get mode only. For instance I prefer using with get mode, but cant find how to do this exclusively. In regards to above, when in cookie mode, I notice the URL can get sloppy as I have put a "?" in case if the user falls back to get mode so their session id can be posted in the URL. So when I enable cookies, I see a "?" at the end of all of my statements. Perhaps revise =SID so it also prints ? at the beginning, or another command to automatically add a ?. Overall, im pretty impressed with PHP4's ability to manage sessions and look forward to the final release of php4 as the design seems somewhat nicer than phplib (Ive not yet encountered any cache issues yet.) I will test the cache portion of session management further but based on initial impressions, it works nicely. Im happy to be able to use this instead of using phplib which can get somewhat confusing at times (e.g. forgetting to do a page_close, and not having registered variables written to the database.) Thanks! Jon Mitchiner ICQ # 21030881 AIM # MinotaurT