Jump to content

Php Preventing session fixation sample code does no work as the book said

pmoh's Photo
Posted Jun 19 2013 06:50 AM
923 Views

Why get same session id with "?PHPSESSID=1234" and "?PHPSESSID=5678"?

Book PHP, MySQL & Javascript (Author Robin Nixon)
page 294
Section Preventing session fixation
Example 13-9. A session susceptible to session fixation
<?php // sessiontest.php
session_start();
if (!isset($_SESSION['count'])) $_SESSION['count'] = 0;
else ++$_SESSION['count'];
echo $_SESSION['count'];
?>

Book said: use url http://myserver.com/...?PHPSESSID=1234 and

url http://myserver.com/...?PHPSESSID=5678
will generate two diffreent session.

When I test it, it looks the count number always increse. It seems the I get same session.

So, I add following lines to test it again,
$ses_id = session_id();
echo "session id: ".$ses_id.'<br />';

I get results below:
---------------------------------------------------------
session id: ifbck2u7oghe82mmbin64ikn66
10
-------------------------------------------------------
<?php // sessiontest.php
session_start();
$ses_id = session_id();
echo "session id: ".$ses_id.'<br />';
if (!isset($_SESSION['count'])) $_SESSION['count'] = 0;
else ++$_SESSION['count'];
echo $_SESSION['count'];
?>

Tags:
0 Subscribe


0 Replies