Question

Hey guys, I was scanning my site for security and I noticed that it was possible for non users to send requests and post information, so I decided to put login checks on all information posts. I was wondering if it was a good way to keep a session id that is created by md5(uniqid()); in a session variable $_SESSION['id']=md5(uniqid()); for each user and then store that in a database under active users for that user. Then when a user tries to insert information, verify that their $_SESSION[‘id’] variable is equal to the one in the database where the username equals their $_SESSION[‘username’]. What are your ideas on this guys? Thanks in advance!

Answer 1

One solution would be to set a session variable called “loggedin” or something when the user logs in, and make sure that variable is set when you do the database updating (call session_start() before doing the SQL calls, and check the variable in $_SESSION before you send the queries). That way, non-logged in users can’t update the database, unless they steal a session from a user already logged in. From what I understand of the problem, this sounds like the simplest solution.

It sounds to me like the solution you came up with is already built into PHP sessions with SESSIONID. A new session in PHP automatically generates a random string identifying your session from the sessions of others. I could be misunderstanding, though.