Hidden sessions

[thunderwap]

hiding sid will help lot of sites who getting hacked by image hack or stealing session.

this can be safe from noob hackers.

any guys using lava must try to hide sessions.

[CreativityKills]

If i got a coin for every topic like this.

[kiLLeR-eyEd_14]

That was just my past used thing or experience in having a session w/o getting it into a url that was done in lavalair..My only point is to give hidden sessions for them to experience having a session w/o having it in a url..

[Mysterio]

it only hiddes the sid, nothing more

[kei_ki7]

i think you dont need to hide sid if you using $_SERVER['PHPSESSID'], $PHPSESSID, session_id() , you are hiding for cleanliness.

[subzero]

djlee, is right lol

Build your own sid i have my script if you tryed to hack sid you only get username lmao

[djlee]

So basically your hiding the real session ID... whats the point lol. Your site translates the user viewable session id into the hidden sid stored in the session. If i have the user viewable session and use it, your site is still gonna translate that into the hidden sid for me. I really dont see the point in such a modification???

or did i understand it wrong :P

[kiLLeR-eyEd_14]

It depends on your script..Example: on lavalair login.php

mysql_query("INSERT INTO ibwf_sessions SET id='".session_id()."' WHERE uid='".getuid_nick($_GET['loguid'])."', expiretm='".(time() + (24*60*60))."'"); 

you then inserted it into the database..Then in every top of a file like index.php..assign session_id() to $sid..

$sid = session_id(); 

now, it will work..this will return your membership id..

$uid = getuid_sid($sid); 

just analyze..this one is the link to your profile..

index.php?action=viewuser&who=$uid 

and then this, on logout

index.php?action=logout&who=$uid 

got my point?the thing i can tell you about this is to be wise 'cause they might abuse it by putting that url in an image source..once you executed that image with that url, example, the source is the logout url, then you will be logged out..

[slayder]

what is this?

[makvanpor2000]

I dont understand use them as in how

[kiLLeR-eyEd_14]

$_SESSION['sid'] = put here the encrypted value to be used as session, $_SERVER['PHPSESSID'], $PHPSESSID, session_id() 

you can use any of them..