" width="11" height="7"/>

session_get_cookie_params

Last updated: Thu, 31 May 2007

session_id

(PHP 4, PHP 5)

session_id — カレントのセッション ID を取得または設定する

説明

string session_id ( [string $id] )

session_id() はカレントのセッション ID を取得または設定するために使用されます。

カレントの名前とセッション ID を、URL に追加可能な文字列として取得するために定数 SID も使用することが可能です。セッションハンドリングも参照してください。

パラメータ

id: id が指定された場合、カレントのセッション ID を置換します。その際、 session_start() より前にコールされている必要があります。セッションハンドラによっては、セッション ID として使用できる文字に制限がある場合があります。例えば、ファイルによるセッションハンドラはセッション ID として使える文字は a-z, A-Z, 0-9 に限られます!
注意: セッション保持にクッキーを使用している場合、 session_id() において id 引数を指定すると、カレントのセッション ID がセットされるものとまったく同一であるかどうかに関わらず、 session_start() が呼び出される際に常に新しいクッキーが送信されます。

返り値

session_id() はカレントのセッションのセッション ID、もしくはカレントセッションが存在しない (カレントのセッション ID が存在しない) 場合は空文字列 ("") を返します。

参考

session_regenerate_id()
session_start()
session_set_save_handler()
session.save_handler

session_is_registered

" width="11" height="7"/>

session_get_cookie_params

Last updated: Thu, 31 May 2007

add a note User Contributed Notes
session_id

Nicu
07-Jul-2007 07:22


Saving sessions to file and generating the ID's with Sha1 and 6 bit/character on Windows machines gives a higher chance of session collision (the filesystem is not case sensitive)

26-Mar-2007 04:06


Regarding Colin's comment, note that setting hash_bits_per_character to 5 results in characters ranging from 0-9 and a-v. Most attackers would be wise enough to realize what was going on when they saw a letter in g-v.  The probability of not seeing a letter in g-v is somewhere around 2^-32.

Colin
09-Mar-2007 03:46


The higher you set session.hash_bits_per_character the shorter your session_id will become by using more bits per character. The possible values are 4, 5, or 6.



When using sha-1 for hashing (by setting ini_set('session.hash_function', 1) the following session string lengths are produced by the three session.hash_bits_per_character settings:



4 - 40 character string

5 - 32 character string

6 - 27 character string 



It would seem desirable to use sha-l with 5 bits_per_character because this will emulate a standard 32 character md5 string and make a would-be attacker think that is what you're hashing with.

masternico at yahoo dot fr
15-Jan-2007 12:03


in addition to what said "jpjounier at hotmail dot com" it's EXTREMELY important to test if "session_id()" gives a result or not.



If you do not, you take the risk to have a new session starting over with the loss of your session variables.



php.ini can be different on each webserver you'll host your script on.



If you only rely on the behavior of your script on one server, you might have trouble on others.



One VERY important session's option of php.ini is 'session.auto_start' . If setted at 'true', session will then start automaticaly for each page that user will open without the need of using session_start().



The point is that if you have a script like this one:

/*****************

verif_logging.php:

*****************/

<?php

    include('includes/class_user');    

    $login = $_POST['login'];

    $pass = $_POST['pass'];

    if($user->connection($login,$pass){ // user logging validation

        session_start();     //start the session

        $_SESSION['user_logged'] = true;  // user logged in

        header('location : control_panel.php');  // go to control panel

    }

    else {  // go back to logging page

        header('location : logging.php?' . $user->error_string);

    }

?>



/****************

control_panel.php:

****************/

<?php

    session_start();

    echo $_SESSION['user_logged'];

?>



All will be ok as long as 'session.auto_start ' is at 'false'. Otherwise, you'll have a brand new session created with empty $_SESSION and new SID.



This has been brain breaker for me until I realise that my webserver has 'session.auto_start' at 'true' and that I couldn't change it (some webhost doesn't let user change php.ini options).



So I changed the code this way:

/***************

control_panel.php:

***************/

<?php

    if (session_id() == "") session_start(); // if no active session we start a new one

    echo $_SESSION['user_logged'];

?>



And then everything is ok regardless if 'session.auto_start' is set to 'false' or 'true'.



Furthermore, as said 'risaac at deadletter dot com' (04-Apr-2006 08:46) in a comment on 'session_write_close()', it might be a clever thing to check if the newly activated session has $_SESSION empty or setted with the value you passed by as expected. If empty, then you might have launched a brand new session and surely lost every fromer data unless you know what was the SID (passed by $_GET for example, not recommended but possible).

22-Aug-2006 05:15


In response to simon at quo dot com dot au:



The PHPSESSID is produced using an hash function. By default, it uses MD5 which produces 128 bits long (i.e: 16 bytes long) hashes.

But, since some bytes' values may not be used in the HTTP header, PHP outputs the hash in its hexadecimal representation, thus resulting in a 32 bytes long text.



Starting with  PHP 5.0, you can change the hash function used (by setting "session.hash_function" to whatever function you want to use in php.ini).

You may for example set it to 1 to switch to SHA-1 which produces 160 bits (20 bytes) long hashes.



Please also note that another setting was introduced in PHP 5 (session.hash_bits_per_character) which sort of "compresses" the hash. Thus, resulting in what seems to be a shorter hash.

This feature helps you improve your application's security by producing IDs that are harder to prodict for a malicious attacker.



More information on those settings is provided on:

http://www.php.net/manual/en/ref.session.php

simon at quo dot com dot au
07-Mar-2006 03:15


Length of PHPSESSID appears to be 32 characters by default.

jwhatcher at hotmail dot com
08-Jul-2005 04:21


Killing the session_id when using cookies to store the session_id. Useful when needing to recreate a user with different session information during an open session.



    unset($_COOKIE[session_name()]);

    session_start();

jpjounier at hotmail dot com
23-Jun-2005 08:28


About the note from Cybertinus : 





The following test doesn't work, the code following is always executed :





if(!session_id())


{


// Always executed even if there's already an opened session


}





session_id() returns an empty string if there is no current session, so to test if a session already exists, it's better to write this :


if(session_id() == "")


{


session_start();


}


else


{


// Anything you want


}

cbarnes at bfinity dot net
10-May-2005 10:44


Note that Firefox and Mozilla use the same process for launching new windows or tabs, they will pick up the same session id as the previous windows until the parent process dies or is closed. This may cause undesired results if the session id is stored in a db and checked, a solution is to check at the new entry point (new tab or window if the user went back to the index page) for an existing session. If a session id exists and a new one is required use something like:



$ses_id = session_id();

$bsid_exists = false;

$bsid_exists = check_session_id_from_db($ses_id);

 if ($bsid_exists){

 //This is a reentry and the session already exists

 // create a new session ID and start a new

session_regenerate_id();         

$ses_id = session_id();

 }

jeff_zamrzla
11-Feb-2005 08:03


Try this code snippet, from a book by a security expert who says this is more secure to place on every page:



session_start();

$_SESSION['name'] = "YourSession"; 



if (!isset($_SESSION['initiated']))

{

    session_regenerate_id();

    $_SESSION['initiated'] = true;

}

karlhaines at comcast dot net
31-Oct-2003 10:05


Rewriting URL's is not suggested for obvious security issues. Please be careful with register_globals when using sessions! Check that all information you recieve from a user is valid before accepting it!

Andi, info at pragmaMx dot org
17-Jan-2003 06:13


you can also add the iframe tag:

ini_set("url_rewriter.tags", "a=href,area=href,frame=src,iframe=src,input=src,form=fakeentry");

add a note

session_is_registered

" width="11" height="7"/>

session_get_cookie_params

Last updated: Thu, 31 May 2007