[bens1901]

I recently received this message "Your script possibly relies on a session side-effect which existed until PHP 4.2.3. Please be advised that the session extension does not consider global variables as a source of data, unless register_globals is enabled. You can disable this functionality and this warning by setting session.bug_compat_42 or session.bug_compat_warn to off, respectively. in Unknown on line 0"

Rather than modify the php.ini file, I'd like to update my Session handling code to be "correct" with the latest version of PHP.

Could anyone suggest the proper code for the new PHP? I've been looking around, but haven't found anything the directly points and says "this is how you do it". I'm currently using Session_start() and Session_register() stuff. I'm thinking that maybe I should switch to just using Session_start() and $_SESSION[''] for my session variables.

Thanks in advance for any advice.

-Ben

[Simon Mundy]

Originally posted by bens1901:
I recently received this message "Your script possibly relies on a session side-effect which existed until PHP 4.2.3. ...

This is an example of what I've been using (where 'SESSION_NAME' and 'SESSION_TIME_LIMIT' are constants I've defined elsewhere):

[php]
session_name(SESSION_NAME);
session_start();

$user = $_SESSION['user'];
$order = $_SESSION['order'];

...blah...
..blah...

$_SESSION['user'] = $user;
$_SESSION['order'] = $order
[/php]

You have to register your variables inside the $_SESSION superglobal before the end of your scripts, otherwise they won't stick.

I have also supplemented session security by doing the following whenever a new session is authorised (via password lookup):

[php]
$session_key = microtime().$login['username'];
$expiration_time = time() + SESSION_TIME_LIMIT;
$passhash = md5($password.PRIVATE_KEY);
$hash = md5($session_key.$expiration_time.PRIVATE_KEY.$pas shash);
setcookie("authSID",$session_key,$expiration_time, "/","",0);
setcookie("authEXP",$expiration_time,$expiration_t ime,"/","",0);
setcookie("authHID",$hash,$expiration_time,"/","",0);
setcookie("authPID",$passhash,$expiration_time,"/","",0);
[/php]

In this example, 'PRIVATE_KEY' is set to an md5 of a secret phrase. This essentially ensures that none of your session variables can be hijacked by someone tampering with browser cookies. The code to validate your current session against the 'correct' variables is:

[php]
function authenticate()
{
return ((INT) $_COOKIE['authHID'] == md5($_COOKIE['authSID'].$_COOKIE['authEXP'].PRIVATE_KEY.$_COOKIE['authPID']) && time() < $_COOKIE['authEXP']);
}
[/php]

...where the authenticate() will return false if the combined hashes of your cookies do not match against your Hash cookie... (no double-meaning intended).

Is this the sort of thing you're after?

[bens1901]

awesome! Thanks for the info :-)