Posted by Sanders Kaufman on 11/01/07 18:38

"floortje" <none@none.none> wrote in message
news:4728ec19$0$286$dbd4d001@news.wanadoo.nl...
> Op 2007-10-31 21:30:58 +0100, zei "Sanders Kaufman" <bucky@kaufman.net>:

>> I use a "loginCookieValue" (UUID) in the users database.
>> Every page-view gets a new one.
>> That way - even if a would-be hacker steals a "session" for one page, it
>> won't be good for the next.
>
> Even better offcourse but i'd still check the ip.

Way ahead of ewe...

function UUID(){
// 31-Character Format: [12345678-1234-1234-123456789012]
return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff ),
mt_rand( 0, 0x0fff ) | 0x4000, mt_rand( 0, 0x3fff ) | 0x8000,
mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff ));
}
$sCookie = $_SERVER['REMOTE_ADDR'] . fnUUID();

[Back to original message]