Opinion on forms -> sessions 1

[alfalf]

Hello.

I just wanted an (or more) opinions about something with PHP/sessions/security.

I have an registration form. First I developed it, with passing values (to processing PHP script) with post method ($_POST).

Then, paralel with that, I developed small class to handle my sessions with MySQL database, as I need to handle my future user sessions .

Then it occured to me that I could also use sessions to pass values through registration forms (registration process). And I made that solution (also added an reg_session database, in order not to mix it with my future user_session database). And I stored those values (from forms) to session data column ($_SESSION). This stuff work all fine and good. Both.

Then, there's fact that I'll have an certificate installed, once I finnish this, and will use SSL protocol/port for secured transmision and perhaps pear to encrypt some data (if I found that necessary).

So now, having in mind that I'll use SSL, what is more secure solution -> to pass values through registration process with $_POST or via session data with $_SESSION (data stored NOT in files but in MySQL database)?
Also, If I pass data with $_SESSION -> I don't have to use hidden fields for saving that data on another form... (e.g. First records form, than I Agree form or something like that).

I asume that session through registration is not uncommon thing. Still, my question remains, what is more secure?

Thanks for any suggestions, opinion or expirience.

 

[sleipnir214]

My take has always been that if you transmit data to the client and back (as in with hidden fields in a form), then it's pretty easy to view the source HTML of the page and tinker with things.

With sessions, the only thing stored on the client side is an index to where the data is stored -- the actual data is on the server. It's possible to tinker with the session cookie's value, but since PHP assigns non-contiguous values to different users' session ids, it is harder to find another session id that will work.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[alfalf]

Thanks! Smart!

 

[hos2]

and if you want to use hidden fields then another option is to use encrypted data

lets say you have a userid with value 4 as an hidden field. then in the usertable also make a userkey. the userkey is for instance encrypted with md5

you can use the userid and concat that with for instance a timestamp or another key. and encrypt that.

in the form you can refer to the userkey instead of the very likely or already know userid's