Hidden sessions

[kiLLeR-eyEd_14]

$_SESSION['sid'] = put here the encrypted value to be used as session, $_SERVER['PHPSESSID'], $PHPSESSID, session_id() 

you can use any of them..

[makvanpor2000]

I dont understand use them as in how

[slayder]

what is this?

[kiLLeR-eyEd_14]

It depends on your script..Example: on lavalair login.php

mysql_query("INSERT INTO ibwf_sessions SET id='".session_id()."' WHERE uid='".getuid_nick($_GET['loguid'])."', expiretm='".(time() + (24*60*60))."'"); 

you then inserted it into the database..Then in every top of a file like index.php..assign session_id() to $sid..

$sid = session_id(); 

now, it will work..this will return your membership id..

$uid = getuid_sid($sid); 

just analyze..this one is the link to your profile..

index.php?action=viewuser&who=$uid 

and then this, on logout

index.php?action=logout&who=$uid 

got my point?the thing i can tell you about this is to be wise 'cause they might abuse it by putting that url in an image source..once you executed that image with that url, example, the source is the logout url, then you will be logged out..

[djlee]

So basically your hiding the real session ID... whats the point lol. Your site translates the user viewable session id into the hidden sid stored in the session. If i have the user viewable session and use it, your site is still gonna translate that into the hidden sid for me. I really dont see the point in such a modification???

or did i understand it wrong :P

[subzero]

djlee, is right lol

Build your own sid i have my script if you tryed to hack sid you only get username lmao

[kei_ki7]

i think you dont need to hide sid if you using $_SERVER['PHPSESSID'], $PHPSESSID, session_id() , you are hiding for cleanliness.

[Mysterio]

it only hiddes the sid, nothing more

[kiLLeR-eyEd_14]

That was just my past used thing or experience in having a session w/o getting it into a url that was done in lavalair..My only point is to give hidden sessions for them to experience having a session w/o having it in a url..

[CreativityKills]

If i got a coin for every topic like this.

[thunderwap]

hiding sid will help lot of sites who getting hacked by image hack or stealing session.

this can be safe from noob hackers.

any guys using lava must try to hide sessions.

[GumSlone]

hiding sid will help lot of sites who getting hacked by image hack or stealing session.

this can be safe from noob hackers.

any guys using lava must try to hide sessions.

if you hide it - you will lose 50% or more of your users, you should better secure your site.

[CreativityKills]

Just secure it. I dnt hide myn bt its secure.

[kei_ki7]

if you hide it - you will lose 50% or more of your users, you should better secure your site.

yes, because some other phone does not supported by phpsessions

Just secure it. I dnt hide myn bt its secure.

i think there is no need to hide the session if cookie is used

[CreativityKills]

I just said i DONT hide mine :-/