Sessions in links 1

[chessbot]

continued from thread434-944096

I have a PHP website in which a user's login is stored in the $_SESSION[] array. The current contents:

$_SESSION['username'] = username;
$_SESSION['password'] = password;
$_SESSION['id'] = id;

The id is taken from a database containing each username and password and a unique id.

Where is this information stored? How does it react with cookies? Should I put it in my <a> tags?

Thank you!

--Chessbot

"See the TURTLE of enormous girth!"
-- Stephen King, The Dark Tower series

 

[sleipnir214]

If you look in php.ini, you will find two runtime configuration settings: session.use_trans_sid and url_rewriter.tags. If session.use_trans_sid is set to 1 or on, then PHP will automagically add session IDs to the tags specified in url_rewriter.tags.

However, passing around the session ID in tags can be a security risk. This from the PHP online manual section titled "Session Handling Functions":

URL based session management has additional security risks compared to cookie based session management. Users may send a URL that contains an active session ID to their friends by email or users may save a URL that contains a session ID to their bookmarks and access your site with the same session ID always, for example.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[chessbot]

Thank you.

Unfortunately, I do not hav access to php.ini. Would this be available through phpinfo()?

I think what I am looking for is a good explanation of sessions. Can someone direct me to one?

--Chessbot

"See the TURTLE of enormous girth!"
-- Stephen King, The Dark Tower series

 

[sleipnir214]

Have you tried faq434-4908


Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Olavxxx]

Why do you have to store the password in a session?

To add the SID to links:
<a href="foo_bar.php?<?=SID?>" title="foobar!">foobar with SID</a>

the same method is used for forms..
either with hidden field:
<input type="hidden" name="SID" value="<?=SID?>" />
or: <form action="?<?=SID?>"...


Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster