Posted by Rik on 08/18/06 08:37

lorenzdominic_@hotmail.com wrote:
> My question is how does PHP know which Session ID is the correct one
> if
>
> I have hundreds of users and I am not giving PHP the correct Session
> ID
>
> just calling a variable from within a Session object?
>
>
> Please help this is really weird and seems buggy??????????

It think you got the wrong idea about how a session works.
As soon as you session_start(), either a cookie will be set, or, depending on
your settings, on on every link a GET variable will be set/hidden POST variables
will be set in the forms. This is a large random string, and identifies the
session.

On the next page request, either the user sends his previous set cookie, or will
tell PHP with GET or POST variable which session it uses. PHP will process this
automatically by session_start() without you having to code for it. It will
check for the existence of the session, and if it exists, will set the session
variables available in that partivular session. If you're worried about sessions
being used by other (unathorized) users, google for session hijacking.

My session id's are 32 byte haxedecimal numbers, 16^32 = +/- 3,4 * 10^38
possibilities (yes, I know the math is somewhat off on this one, it's just for
illustration). 10^38 possibilities will mean that even with hundreds of users,
someone has to be very, very, very lucky just to guess an active session. A few
extra check can be placed and it will be very safe.

Grtz,
--
Rik Wasmus

[Back to original message]