Re: [PHP] Session expiry issues in IE, still.

2004-01-05 Thread Chris Shiflett
Hi Tarrant, --- Tarrant Costelloe [EMAIL PROTECTED] wrote: I wrote to the list a couple of days ago about issues Planet-Tolkien.com members were experiencing with Internet Explorer, where their PHP based $_SESSION seemed to be expiring very speradically, where as Mozilla and Opera browsers

Re: [PHP] Session logic question

2004-01-02 Thread Chris Shiflett
--- Al [EMAIL PROTECTED] wrote: Everything works fine, except when I include another script file that also uses the $_SESSION buffer. What appears to be happening is that start_session() on the second script reinitializes the session buffer and I lose the data from the first session.

Re: [PHP] Session logic question

2004-01-02 Thread Al
Thanks for the reply. i just found the bug in my code. I had a statement in the second script: $_SESSION = $array; that obviously, completely replaced everything in the $_ SESSION buffer. These little I gotchas can be fun. Chris Shiflett wrote: --- Al [EMAIL PROTECTED] wrote:

Re: [PHP] session / garbage collection problem

2003-12-19 Thread Marek Kilimajer
What filesystem and OS is this? Anthony Kaufman wrote: PHP Version 4.2.2 Apache 2 RH 9 The problem is that session files in the /tmp directory are completely cleared out at random intervals of time. We assume that the randomness is due to our session.gc_probability setting of 1 causing it to run

Re: [PHP] session / garbage collection problem

2003-12-19 Thread Anthony Kaufman
Redhat 9 kernel 2.4.20-18.9bigmem ext3 fs Marek Kilimajer [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] What filesystem and OS is this? Anthony Kaufman wrote: PHP Version 4.2.2 Apache 2 RH 9 The problem is that session files in the /tmp directory are completely cleared

Re: [PHP] session / garbage collection problem

2003-12-19 Thread Tony Crockford
On Fri, 19 Dec 2003 13:37:06 -0800, Anthony Kaufman wrote: PHP Version 4.2.2 Apache 2 RH 9 The problem is that session files in the /tmp directory are completely cleared out at random intervals of time. We assume that the randomness is due to our session.gc_probability setting of 1 causing it

Re: [PHP] session / garbage collection problem

2003-12-19 Thread Anthony Kaufman
Well, we host our own so what I was thinking wouldn't quite work for your situation. However, I've seen a method that I think would work pretty well for you. Basically, you store all the data you want to be persistant between requests in a database. You could use the session id you get from the

RE: [PHP] Session Link Problems

2003-12-12 Thread Ford, Mike [LSS]
On 12 December 2003 00:03, Steve Turner wrote: Hi, I am having a problem with sessions. On my testing machine my script works perfectly. However on the remote server it tries to pass the session id in the url even though I am accepting cookies. It is messing up all my links since it

Re: [PHP] Session Link Problems

2003-12-12 Thread Peter Walter
Steve, As Mike said, I have a similar problem. I am using PHP 4.1.2. What release are you using? Peter Mike Ford wrote: On 12 December 2003 00:03, Steve Turner wrote: Hi, I am having a problem with sessions. On my testing machine my script works perfectly. However on the remote server it

Re: [PHP] session var not being passed?

2003-12-12 Thread Jason Wong
On Saturday 13 December 2003 05:48, Jas wrote: New set of eyes maybe or maybe I am indeed regressing... Page calling functions looks like such... [snip] session_unset($_SESSION['list']); [snip] You seem to be mistaken as to what session_unset() actually does. For a start it

Re: [PHP] session with output compression?

2003-12-10 Thread Chris Shiflett
Hi Matthias, --- Matthias Nothhaft [EMAIL PROTECTED] wrote: I wanna use PHP's session management with output compression, but I have the following problem: Session-IDs are not automatically appended to URLs. :-( [snip] I guess the problem is that PHP can not append SID in (g)ziped

Re: [PHP] session with output compression?

2003-12-10 Thread Jason Wong
On Wednesday 10 December 2003 23:56, Chris Shiflett wrote: --- Matthias Nothhaft [EMAIL PROTECTED] wrote: I wanna use PHP's session management with output compression, but I have the following problem: Session-IDs are not automatically appended to URLs. :-( [snip] I guess the

Re: [PHP] Session Expiration Problem....

2003-12-04 Thread SLanger
Hello Have you considered breaking down your form into several smaller ones on seperate pages like a wizard? In each step you can save the entered data preventing it from being lost. In the end show the whole form with all data for verification by the user. Regards Stefan Langer

Re: [PHP] Session Expiration Problem....

2003-12-04 Thread CF High
Hey Lowell. H, no, not a particularly elegeant solution, but it must work for you. I'm experimenting with ini_set('session.gc_maxlifetime', 4320); Don't know if this will extend the session timeout; i.e. garbage collection routine, I'm still testing it. A total drag that our host

Re: [PHP] Session Expiration Problem....

2003-12-03 Thread Matt Matijevich
snip Is there a way to extend the php session timeout for particular pages? Alternatively, is there a way, other than using cookies, to store user data from page-to-page? /snip I think you can use ini_set() to change session.gc_maxlifetime, that will change your session timeout. You could pass

Re: [PHP] Session Expiration Problem....

2003-12-03 Thread Lowell Allen
Our hosting company sets session vars to expire every 15 minutes. I've setup an Admin Center for users to enter various types of information, some of which, for example entering a basketball team roster, can take slower users upwards of 25 minutes or more. The result? Admin user spends

Re: [PHP] Session Expiration Problem....

2003-12-03 Thread Matt Matijevich
** Low Priority ** snip Is there a way to extend the php session timeout for particular pages? Alternatively, is there a way, other than using cookies, to store user data from page-to-page? /snip I think you can use ini_set() to change session.gc_maxlifetime, that will change your session

Re: [PHP] Session Expiration Problem....

2003-12-03 Thread John W. Holmes
Matt Matijevich wrote: snip Is there a way to extend the php session timeout for particular pages? Alternatively, is there a way, other than using cookies, to store user data from page-to-page? /snip I think you can use ini_set() to change session.gc_maxlifetime, that will change your session

[PHP] Re: PHP SESSION DURATION.....

2003-11-25 Thread Keith
Correction: I meant to say: Are session variables stored server-side or client-side like cookies? Keith [EMAIL PROTECTED] wrote in message news:[EMAIL PROTECTED] Hi, How do I go about making a session last longer that the duration of the browser? Say I wanted to make a session last for 1

Re: [PHP] Re: PHP SESSION DURATION.....

2003-11-25 Thread Larry E. Ullman
Correction: I meant to say: Are session variables stored server-side or client-side like cookies? The session data is stored on the server. The session cookie (if there is one) is stored in the browser. How do I go about making a session last longer that the duration of the browser? Set the

Re: [PHP] SESSION wierdness....

2003-11-20 Thread Jason Wong
On Thursday 20 November 2003 14:34, David HM Spector wrote: I'm seeing really odd behavior using session variables and wonder if I'm really just missing something obvious... My env is: RH9, httpd-2.0.40-21.5, PHP 4.2.2 (RH RPM, gazillion compile flags enabled), session support enabled,

Re: [PHP] SESSION wierdness....

2003-11-20 Thread Rob Burris
David HM Spector wrote: I am writing a multi-page form, on the first page I session_register() a mess of variables (8 of them), the first time through the form everything works as expected, I can get things out of form variables and into relevant the $_SESSION variables. Items are put

Re: [PHP] Session vars not echoing?

2003-11-20 Thread John W. Holmes
Jas wrote: [Script registering vars - sessions.php] /* Format Date Time */ $hour = (date(H:i:s)); $day = (date(d)); $date = (date(F $day, Y)); Don't you mean $data = date('F d, Y'); I don't see why you're calculating $day and then putting it in date(). /* Register vars */ $_SESSION['date'] =

Re: [PHP] Session trubles

2003-11-19 Thread Marek Kilimajer
mgraf wrote: PHP Version: 4.2.2 Hi I had a problem with my session name. In the php.ini, was set the default name PHPSESSID from the default installation. Now i have the problem, that i use the name audience for my webapplikations with PHPope (http://www.phpope.org) I Set the name in the

Re: [PHP] Session trubles

2003-11-19 Thread mgraf
PHP Version 4.3.3 Ok i have disabled the autostart. Now is my problem, that php us the transparent sessions, because it append it in the URL. After the login, all works fine, but after 5-6 clicks, i loose the session. It send me a Cookie : Set-Cookie: audience=a01b3fcf7cb587eee3ac61bc83edebe4;

Re: [PHP] Session trubles

2003-11-19 Thread Marek Kilimajer
mgraf wrote: PHP Version 4.3.3 Ok i have disabled the autostart. Now is my problem, that php us the transparent sessions, because it append it in the URL. After the login, all works fine, but after 5-6 clicks, i loose the session. It send me a Cookie : Set-Cookie:

Re: [PHP] Session trubles

2003-11-19 Thread mgraf
Thanks that was my problem :-) On Wed, 19 Nov 2003, Marek Kilimajer wrote: The first parameter is relative to the current time. I would recomend for security reasons to leave this to the default, 0 - until the browser is closed. Otherwise this could lead to session hijacking - when the bad

Re: [PHP] session timeout

2003-11-13 Thread CPT John W. Holmes
From: pete M [EMAIL PROTECTED] How do I set the session timeout - eg someone leaves a broweser for say half an hour then have to log in again.. As I'm on an intranet I want to increase ro 3 hours Exact method: Save the current time on each request in the session. On each request, check that

Re: [PHP] session timeout

2003-11-13 Thread Marek Kilimajer
pete M wrote: How do I set the session timeout - eg someone leaves a broweser for say half an hour then have to log in again.. As I'm on an intranet I want to increase ro 3 hours Pete increase the value of session.gc_maxlifetime (in seconds), session.cookie_lifetime should be still 0 (untill

Re: [PHP] session timeout

2003-11-13 Thread CPT John W. Holmes
From: [EMAIL PROTECTED] How do I set the session timeout - eg someone leaves a broweser for say half an hour then have to log in again.. As I'm on an intranet I want to increase ro 3 hours Pete, Change the default configuration of the option session.cookie_lifetime in the php.ini This

RE: [PHP] session variables scope problem. HELP!

2003-11-13 Thread Johnson, Kirk
It seems that once a session is started and variables set, I can access the variables on the page on which they are set, but on subsequent pages via link or Header redirect the session variables are not set and cannot be accesses. Be sure you have session_start() at the top of *all*

Re: [PHP] session vars for other session name

2003-11-10 Thread Marek Kilimajer
David T-G wrote: Hi, all -- I have a picture gallery application which uses sessions. As part of the config we set the session name; the default is 'locscout'. I also have a portfolio/presentation application layered on top of this (and almost ready for release! :-) :-) with its own session

Re: [PHP] session vars for other session name

2003-11-10 Thread David T-G
Marek, et al -- ...and then Marek Kilimajer said... % % David T-G wrote: % % I have a picture gallery application which uses sessions. As part of the % config we set the session name; the default is 'locscout'. % % I also have a portfolio/presentation application layered on top of this % (and

Re: [PHP] session vars for other session name

2003-11-10 Thread Marek Kilimajer
David T-G wrote: I'm a bit confused... I haven't tried this yet, so maybe it will all come clear when I do, but I'm still confused! So where I currently have session_name($wfname) ; session_start ; ... I'd instead have session_name($wfname) ; $_COOKIE[$wfname] = $_COOKIE['locscout'] ;

Re: [PHP] session vars for other session name

2003-11-10 Thread David T-G
Marek, et al -- ...and then Marek Kilimajer said... % % David T-G wrote: ... % or so. But what does that buy me? How will then setting my password at % one level (presentation) also set it at another (gallery)? % % You will have the same session variables accessible in your script. Oho.

[PHP] Re: PHP session won't die!

2003-11-08 Thread DvDmanDT
setcookie(session_name(),,0,/); session_unset(); session_destroy(); or something like that... -- // DvDmanDT MSN: dvdmandt¤hotmail.com Mail: dvdmandt¤telia.com ## Please, if you are using windows, you may be infected by Swen. Please go here to find out more:

Re: [PHP] Session for creating a unique shopping cart for each user

2003-10-31 Thread Gareth Williams
Have you already sent anything to the browser? Once the first echo has been performed, you can't send header information, as the header is sent with the first bit of text. On Friday, Oct 31, 2003, at 15:47 Europe/Amsterdam, Tore E. Mackay wrote: Hi, I am creating a shopping cart but

Re: [PHP] Session for creating a unique shopping cart for each user

2003-10-31 Thread Tore E. Mackay
Don't realy know. Here is what I have: 1. An index.php that inculdes products.php if $file=products.php. 2. products.php includes db.php that contains databse connection and the code for creating a session. 3. When I click add product $file=cart.php and cart.php includes the db.php file that

Re: [PHP] Session for creating a unique shopping cart for each user

2003-10-31 Thread Gareth Williams
Do you see any information in your browser before the error appears? Perhaps you could also do a view source from the browser to see if anything has been sent out. On Friday, Oct 31, 2003, at 16:06 Europe/Amsterdam, Tore E. Mackay wrote: Don't realy know. Here is what I have: 1. An

Re: [PHP] Session for creating a unique shopping cart for each user

2003-10-31 Thread pete M
why use a cookie - the $_SESSION is itself a cookie I'd code it like php session_start() if (!isset($_SESSION['cart_id'])) { // code to get cart_id $_SESSION['cart_id'] = $cart_id; } include(db) include(products) Tore E. Mackay wrote: Don't realy know. Here is what I have: 1.

Re: [PHP] Session Timeout

2003-10-29 Thread Marek Kilimajer
Better solution would be to display your login form together with all get and post variables in hidden fields. If the user logs in sucessfully, your script can continue with processing the form data. [EMAIL PROTECTED] wrote: right of course, 1440 is only 24 minutes. On Tuesday, October 28,

RE: [PHP] Session Timeout

2003-10-28 Thread Pablo Gosse
On Tuesday, October 28, 2003 6:46 PM wrote: Hi there, i am experiencing a session timeout problem with one of my projects. One of the users had left their machine for less than 15 mins, maybe a bit more and it logged them out when posting data. This isnt good as they lost their data. I was

RE: [PHP] Session Timeout

2003-10-28 Thread daniel
right of course, 1440 is only 24 minutes. On Tuesday, October 28, 2003 6:46 PM wrote: Hi there, i am experiencing a session timeout problem with one of my projects. One of the users had left their machine for less than 15 mins, maybe a bit more and it logged them out when posting data. This

Re: [PHP] Session problem

2003-10-27 Thread Manisha Sathe
ok, i am putting it the code in both files, now my first.php is as follows //start the session - in all the pages session_start(); var_dump(ini_get('variables_order')); var_dump(isset($_SESSION)); var_dump($_SESSION); //store it like that $_SESSION[name]= Rinku; -

Re: [PHP] Session problem

2003-10-27 Thread Jason Wong
On Tuesday 28 October 2003 08:33, Manisha Sathe wrote: ok, i am putting it the code in both files, now my first.php is as follows [code snipped] The code looks OK. Things you can do to try track down the problem: 1) As always, turn on FULL error reporting and check the logs 2) Verify that your

Re: [PHP] Session problem

2003-10-26 Thread Evan Nemerson
Your Linux server probably has error_reporting set to 0, which is usually a good idea for production environments. To supress the error messages without modifying your php.ini, do error_reporting(0). Take a look in your php.ini file- the error_reporting directive will have lots of comments

Re: [PHP] Session problem

2003-10-26 Thread Manisha Sathe
It works well on linux means it shows me o/p as 'Manisha' but on local Win2kserver, it gives error. I tried to make use of error_reporting(0); in second.php but then screen becomes blank, it does not show me the output as Manisha manisha Evan Nemerson [EMAIL PROTECTED] wrote in message

Re: [PHP] Session problem

2003-10-26 Thread Manisha Sathe
Hi, do u mean to say put this codes in php ? I tried to put it in second.php following is the msg - -- string(5) EGPCS bool(false) Notice: Undefined variable: _SESSION in C:\Project Codes\Vanderveer\www\testPHP\second.php on line 4 NULL Warning:

Re: [PHP] Session problem

2003-10-26 Thread dark
Hi, session_start has to be the first command this time. try again and the result will look better, maybe explaining. so it should look like: ? session_start(); var_dump(ini_get('variables_order')); var_dump(isset($_SESSION)); var_dump($_SESSION); ? angel On Sun, 26 Oct 2003 17:47:38 +0800

Re: [PHP] Session output question

2003-10-22 Thread CPT John W. Holmes
From: Susan Ator [EMAIL PROTECTED] 1) Is there any way to print out active sessions names? I have $_SESSION['SID'], $_SESSION['uid'], $_SESSION['msg'] can I output the literal strings: $_SESSION['SID'] $_SESSION['uid'] $_SESSION['msg'] $keys = array_keys($_SESSION); 2) Is there any way

RE: [PHP] Session output question

2003-10-22 Thread Susan Ator
Perfect. Thank you so much. That was exactly what I needed. Susan -Original Message- From: CPT John W. Holmes [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 22, 2003 1:53 PM To: Susan Ator; [EMAIL PROTECTED] Subject: Re: [PHP] Session output question From: Susan Ator [EMAIL

Re: [PHP] Session output question

2003-10-22 Thread Curt Zirzow
* Thus wrote Susan Ator ([EMAIL PROTECTED]): 2) Is there any way to use a variable in a session name? can I do: $msg=20031022 $_SESSION[$msg.name] becomes $_SESSION['20031022name'] In this case the _SESSION key is 20031022.name. You'll want something

Re: Re[4]: [PHP] Re: Tom-Re: [PHP] session hijacking

2003-10-21 Thread - Edwin -
Hi, On Tue, 21 Oct 2003 14:02:58 +1000 Tom Rogers [EMAIL PROTECTED] wrote: Hi, Tuesday, October 21, 2003, 1:40:20 PM, you wrote: OMH One other thing.. What's the difference in $$ for a site to be OMH https rather than http?? Cos you need to get a verisign cert OMH or something?? Just

RE: [PHP] Session hijacking

2003-10-21 Thread Joseph Bannon
i setup my sessions to be transparent, can it still be hacked ? What is a transparent session? J. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

RE: [PHP] Session hijacking

2003-10-21 Thread Robert Cummings
On Tue, 2003-10-21 at 15:36, Joseph Bannon wrote: i setup my sessions to be transparent, can it still be hacked ? What is a transparent session? I don't know if it's the same for the original poster (whoever that is, since they were cropped :) For me it's when I bind a session variable to

RE: [PHP] Session hijacking

2003-10-21 Thread Chris Shiflett
--- Robert Cummings [EMAIL PROTECTED] wrote: What is a transparent session? I don't know if it's the same for the original poster (whoever that is, since they were cropped :) For me it's when I bind a session variable to an object such that the session variable is referenced using

Re: [PHP] Session within a session lock?

2003-10-21 Thread John W. Holmes
Steve Wardell wrote: I have a page on my PHP site that needs to access itself. I open a socket connection and pass in the HTTP request header including a cookie string such as: Cookie: PHPSESSID=766bc531e9185be6b54206c944f258d9 With the session name and id of the user's current session (as I

Re: [PHP] Session within a session lock?

2003-10-21 Thread Chris Shiflett
--- Steve Wardell [EMAIL PROTECTED] wrote: I have a page on my PHP site that needs to access itself. I open a socket connection and pass in the HTTP request header including a cookie string such as: Cookie: PHPSESSID=766bc531e9185be6b54206c944f258d9 With the session name and id of the

Re: [PHP] Session within a session lock?

2003-10-21 Thread Steve Wardell
Thanks guys. Makes sense. This is a conversion from ColdFusion and was not an issue in ColdFusion, thou in CF you could do read or write locking to allow for such situations. I'll rework things. Steve John W. Holmes wrote: Steve Wardell wrote: I have a page on my PHP site that needs to

Re: [PHP] Session migration problem...

2003-10-20 Thread Chris Shiflett
--- Jake McHenry [EMAIL PROTECTED] wrote: $result = mysql_query(SELECT * FROM `users` WHERE `uname` = '.$_POST['username'].'); Don't put uname in single quotes. Aside from that, don't forget that you can interpolate variables with curly braces. Depending on your personal preference, you might

RE: [PHP] Session migration problem...

2003-10-20 Thread Jake McHenry
-Original Message- From: Chris Shiflett [mailto:[EMAIL PROTECTED] Sent: Monday, October 20, 2003 9:56 PM To: Jake McHenry; [EMAIL PROTECTED] Subject: Re: [PHP] Session migration problem... --- Jake McHenry [EMAIL PROTECTED] wrote: $result = mysql_query(SELECT * FROM `users

RE: [PHP] Session migration problem...

2003-10-20 Thread Jake McHenry
-Original Message- From: Chris Shiflett [mailto:[EMAIL PROTECTED] Sent: Monday, October 20, 2003 9:56 PM To: Jake McHenry; [EMAIL PROTECTED] Subject: Re: [PHP] Session migration problem... --- Jake McHenry [EMAIL PROTECTED] wrote: $result = mysql_query(SELECT * FROM `users

RE: [PHP] Re: Tom-Re: [PHP] session hijacking

2003-10-20 Thread Ow Mun Heng
Hi Tom, I've got a question for you regarding this encrypt class of yours.. Just wanted to understand how well it would work against a guy with a sniffer such as ethereal. (presuming he's on the LAN/wifi to access the app) How does the encryption happen?? Client side or server side? How does it

RE: [PHP] Session migration problem...

2003-10-20 Thread Jake McHenry
-Original Message- From: Jake McHenry [mailto:[EMAIL PROTECTED] Sent: Monday, October 20, 2003 10:32 PM To: [EMAIL PROTECTED] Subject: RE: [PHP] Session migration problem... -Original Message- From: Chris Shiflett [mailto:[EMAIL PROTECTED] Sent: Monday, October 20

Re[2]: [PHP] Re: Tom-Re: [PHP] session hijacking

2003-10-20 Thread Tom Rogers
Hi, Tuesday, October 21, 2003, 12:52:33 PM, you wrote: OMH Hi Tom, OMH I've got a question for you regarding this encrypt class of yours.. Just OMH wanted to understand how well it would work against a guy with a sniffer OMH such as ethereal. (presuming he's on the LAN/wifi to access the app)

RE: Re[2]: [PHP] Re: Tom-Re: [PHP] session hijacking

2003-10-20 Thread Ow Mun Heng
The encryption happens server side and is really only intended to encrypt variables that are passed to web client such as product id and stuff. The only way to do secure login and prevent sniffing is to use ssl which will encrypt the traffic to and from the client. I suppose javascript could be

RE: [PHP] Session migration problem...

2003-10-20 Thread Chris Shiflett
--- Jake McHenry [EMAIL PROTECTED] wrote: I took the single quotes off of the field name, uname, but still getting the same error at the same line in the file... Any other suggestions? Sure. Let's look at your original code: $result = mysql_query(SELECT * FROM `users` WHERE `uname` =

Re: [PHP] Session migration problem...

2003-10-20 Thread Curt Zirzow
* Thus wrote Jake McHenry ([EMAIL PROTECTED]): -Original Message- From: Chris Shiflett [mailto:[EMAIL PROTECTED] --- Jake McHenry [EMAIL PROTECTED] wrote: $result = mysql_query(SELECT * FROM `users` WHERE `uname` = '.$_POST['username'].'); select * from users where

RE: [PHP] Session migration problem...

2003-10-20 Thread Chris Shiflett
--- Jake McHenry [EMAIL PROTECTED] wrote: Is there any advantage to the curly brackets over the '..'? There's not enough difference between the two to choose one over the other based on performance, if that's what you mean. Personally, I find that concatenation looks clearer in some cases, and

Re[4]: [PHP] Re: Tom-Re: [PHP] session hijacking

2003-10-20 Thread Tom Rogers
Hi, Tuesday, October 21, 2003, 1:40:20 PM, you wrote: OMH One other thing.. What's the difference in $$ for a site to be https rather OMH than http?? Cos you need to get a verisign cert or something?? Just OMH asking.. I use bulkregister.com and if you are a member the cost is $88.00 per year

Re: [PHP] Session migration problem...

2003-10-20 Thread Curt Zirzow
* Thus wrote Chris Shiflett ([EMAIL PROTECTED]): --- Jake McHenry [EMAIL PROTECTED] wrote: Is there any advantage to the curly brackets over the '..'? There's not enough difference between the two to choose one over the other based on performance, if that's what you mean. Personally, I find

Re: [PHP] session hijacking

2003-10-19 Thread daniel
registered globals off ? Hi, We have a site that runs a kind of membership section. When a person logs in we have his username + 3 variables in session, the 3 variables are used for background processing and are never disclosed to the client, all 3 variables contain 1 or 2 digit numbers.

Re: [PHP] session hijacking

2003-10-19 Thread Chris Shiflett
--- Ryan A [EMAIL PROTECTED] wrote: Somehow 1 person has found out about them and is creating havoc with that damn account by changing those variables to differient numbers ...any idea how he is doing that? I have many ideas. First of all, I bet you are using PHP sessions, and you have done

Re: [PHP] session hijacking

2003-10-19 Thread Tom Rogers
Hi, Monday, October 20, 2003, 10:09:42 AM, you wrote: RA Hi, RA We have a site that runs a kind of membership section. RA When a person logs in we have his username + 3 variables in session, the 3 RA variables are used for background processing and are never disclosed to the RA client, all 3

[PHP] Tom-Re: [PHP] session hijacking

2003-10-19 Thread Ryan A
Hi Tom, Thanks for replying. encrypt the numbers and decrypt them before use, if they wont decrypt to a nuber ditch the connection. If you need a class for that I can send it to you Yes please, that should help, but am new to classes so one or two lines on how to implement them would be

[PHP] Shiflett-Re: [PHP] session hijacking

2003-10-19 Thread Ryan A
Hi, Thanks for replying. First of all, I bet you are using PHP sessions, and you have done nothing beyond getting them to work, right? One important note about PHP sessions is that they provide the mechanism only; it is your job to provide whatever security you deem appropriate. Yep, I

[PHP] Re: Tom-Re: [PHP] session hijacking

2003-10-19 Thread Tom Rogers
Hi, Monday, October 20, 2003, 10:38:23 AM, you wrote: RA Hi Tom, RA Thanks for replying. encrypt the numbers and decrypt them before use, if they wont decrypt to a RA nuber ditch the connection. If you need a class for that I can send it to you RA Yes please, that should help, but am new to

[PHP] Re: Tom-Re: [PHP] session hijacking

2003-10-19 Thread Ryan A
Hi Tom, A mighty big thanks for that class, I'll read up on classes tonight and try to understand it. Thanks for the tips on how to use it too. To help prevent problems with stuff like this it is always a good idea to declare variables before using them, especially with sessions: $num = 0;

[PHP] Re[2]: Tom-Re: [PHP] session hijacking

2003-10-19 Thread Tom Rogers
Hi, RA If i declare them before using them like the above example...do you think I RA still need to use that class? RA Cheers, RA -Ryan That depends on what your dicky friend is doing to screw your code up. If you are passing ids' in the url or in post data then encode them. If he is

Re: [PHP] Shiflett-Re: [PHP] session hijacking

2003-10-19 Thread Chris Shiflett
--- Ryan A [EMAIL PROTECTED] wrote: Yep, I just created the session and nothing beyond. Am new to PHP and first time/project user with sessions. Right. I think this needs to be made clearer in the manual myself, and I might add something to drive the point home. PHP sessions are a mechanism,

Re: [PHP] Session hijacking

2003-10-19 Thread Chris Wanstrath
Lots of great information in this thread as far as solutions go, but what I'm wondering is the concept behind how someone actually can hijack a session if register_globals is off. Should all this encryption and added protection be added to scripts with register_globals off and when steps are made

Re: [PHP] Session hijacking

2003-10-19 Thread Chris Shiflett
--- Chris Wanstrath [EMAIL PROTECTED] wrote: Lots of great information in this thread as far as solutions go, but what I'm wondering is the concept behind how someone actually can hijack a session if register_globals is off. I proposed a talk on this at ApacheCon (in addition to my PHP Attacks

Re: [PHP] Session hijacking

2003-10-19 Thread daniel
i setup my sessions to be transparent, can it still be hacked ? --- Chris Wanstrath [EMAIL PROTECTED] wrote: Lots of great information in this thread as far as solutions go, but what I'm wondering is the concept behind how someone actually can hijack a session if register_globals is off. I

Re: [PHP] Session hijacking

2003-10-19 Thread Chris Shiflett
--- [EMAIL PROTECTED] wrote: i setup my sessions to be transparent, can it still be hacked ? Yes. If you can be more specific, I will try to be more specific also. :-) Chris = My Blog http://shiflett.org/ HTTP Developer's Handbook http://httphandbook.org/ RAMP Training Courses

Re: [PHP] Session hijacking

2003-10-19 Thread John W. Holmes
Chris Shiflett wrote: For example, consider that a legitimate user clicks a link and goes to this URL: http://www.example.org/foo.php?PHPSESSID=12345 Perhaps the user has cookies disabled, so PHP appends the session identifier to the URL, or perhaps the developer does it automatically. Either

Re: [PHP] Session hijacking

2003-10-19 Thread Chris Shiflett
--- John W. Holmes [EMAIL PROTECTED] wrote: Either way, what if a bad guy visits this URL: http://www.example.org/foo.php?PHPSESSID=12345 Called session fixation. Here's good paper on this and how to deal with it. http://www.acros.si/papers/session_fixation.pdf Actually, I didn't

Re: [PHP] SESSION Not behaving II: permission denied(13)

2003-10-18 Thread Burhan Khalid
[-^-!-%- wrote: Yep. It's me again. 96 hours into the battle, and SESSIONS are still winning. I've written my login script and is now getting the following error. Please advise. Warning: open(/tmp/sess_a690c089dead297c95034d9fe243f860, O_RDWR) failed: Permission denied (13) in Unknown on line 0

Re: [PHP] SESSION Not behaving II: permission denied(13)

2003-10-18 Thread James Kaufman
On Sat, Oct 18, 2003 at 03:44:31PM +0300, Burhan Khalid wrote: [-^-!-%- wrote: Yep. It's me again. 96 hours into the battle, and SESSIONS are still winning. I've written my login script and is now getting the following error. Please advise. Warning:

Re: [PHP] SESSION Not behaving II: permission denied(13)

2003-10-18 Thread [-^-!-%-
That would be one solution, but I am on a shared hosting server. I cannot change the folder permissions. I've asked tech support to look into this. Does anyone know where I can get a class that will save the session vars to mysql? =P e p i e D e s i g n s www.pepiedesigns.com Providing

Re: [PHP] SESSION Not behaving II: permission denied(13)

2003-10-18 Thread Duncan Hill
That would be one solution, but I am on a shared hosting server. I cannot change the folder permissions. I've asked tech support to look into this. Does anyone know where I can get a class that will save the session vars to mysql? I ended up modifying the example of a postgres handler to

RE: [PHP] SESSION Not behaving II: permission denied(13)

2003-10-18 Thread Javier Muniz
PROTECTED] Sent: Saturday, October 18, 2003 2:35 PM To: Burhan Khalid Cc: [EMAIL PROTECTED] Subject: Re: [PHP] SESSION Not behaving II: permission denied(13) That would be one solution, but I am on a shared hosting server. I cannot change the folder permissions. I've asked tech support to look

RE: [PHP] SESSION Not behaving II: permission denied(13)

2003-10-18 Thread Javier Muniz
Err, make that session_set_save_handler :) -Original Message- From: Javier Muniz [mailto:[EMAIL PROTECTED] Sent: Saturday, October 18, 2003 4:27 PM To: [EMAIL PROTECTED] Subject: RE: [PHP] SESSION Not behaving II: permission denied(13) Look at on_session_save_handler in the manual, I

Re: [PHP] Session cookie issue...

2003-10-17 Thread Marek Kilimajer
Jake McHenry wrote: John W. Holmes wrote: I think just upgrading PHP and still using Apache2 will fix this bug, though, and it should still work (it'll be dependent upon what extensions you use and whether they are supported with Apache2). Extensions.. As in file name extensions? No, John means

Re: [PHP] Session not getting destroyed !

2003-10-17 Thread David Otton
On Fri, 17 Oct 2003 15:58:36 +0530, you wrote: My session is not getting destroyed once i close the browser. Problem is only in IE 5 as IE 6+ its getting destroyed. I don't know what is the problem. I looked at the session settings parameters in php.ini file but couldn't figure it out. I am

Re: [PHP] Session not getting destroyed !

2003-10-17 Thread Binay
Yes its showing 0 only.. Its a weird kind of problem for me .. - Original Message - From: David Otton [EMAIL PROTECTED] To: Binay [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Friday, October 17, 2003 4:16 PM Subject: Re: [PHP] Session not getting destroyed ! On Fri, 17 Oct 2003 15:58

Re: [PHP] Session not getting destroyed !

2003-10-17 Thread PHP Webmaster
Subject: Re: [PHP] Session not getting destroyed ! On Fri, 17 Oct 2003 15:58:36 +0530, you wrote: My session is not getting destroyed once i close the browser. Problem is only in IE 5 as IE 6+ its getting destroyed. I don't know what is the problem. I looked at the session settings parameters

Re: [PHP] Session not getting destroyed !

2003-10-17 Thread David Otton
On Fri, 17 Oct 2003 16:46:45 +0530, you wrote: Yes its showing 0 only.. Its a weird kind of problem for me .. Is the browser really being closed? SID caught in a bookmark? Broken cache? Try starting from bare - delete all IE cookies and run the tests again. Check the cookie on the client

Re: [PHP] Session not getting destroyed !

2003-10-17 Thread Marek Kilimajer
Don't you have an old cookie in your IE 5? Try clearing all cookies. Binay wrote: Hi all, My session is not getting destroyed once i close the browser. Problem is only in IE 5 as IE 6+ its getting destroyed. I don't know what is the problem. I looked at the session settings parameters in

Re: [PHP] Session cookie issue...

2003-10-16 Thread John W. Holmes
Jake McHenry wrote: In my original script, I had the main document using cookies. Now that I'm setting up session, when I retrieve the cookie and put it in the browser in my original script, I get NTCookie appended to the data stored in the original cookie. NTCookie is what I have the name of the

RE: [PHP] Session cookie issue...

2003-10-16 Thread Jake McHenry
John W. Holmes wrote: Jake McHenry wrote: In my original script, I had the main document using cookies. Now that I'm setting up session, when I retrieve the cookie and put it in the browser in my original script, I get NTCookie appended to the data stored in the original cookie. NTCookie is

<    4   5   6   7   8   9   10   11   12   13   >