Anti session hijacking

[subzero]

core or what ever script your using.....

function page_protect() 
{
session_start();

if (isset($_SESSION['HTTP_USER_AGENT']))
{
    if ($_SESSION['HTTP_USER_AGENT'] != md5($_SERVER['HTTP_USER_AGENT']))
    {
        login();
        exit;
    }
  }
}
function login()
{
session_start();
if(isset($_SESSION['sid']) || isset($_COOKIE['sid'])) {

Enter your sql for your own site !!

} 

How to use

Under core or what ever !

page_protect(); 

Add a thanks here or the button !!

[frostymarvelous]

Don't get it. If ua is not equal to session saved ua you should login? I'm on mobile so I might be reading this wrong. But how is that supposed to work?
When do you store the Md5 session? You didn't show that.

Btw that looks like the code I proposed yesterday. Just saying.

[subzero]

this makes sid go away.

Also making it harder to read from hijackers that know your cookies and id names also stops them by sending your browser as fake sid other then real sid.

its like a clone but your only know its only a trick to others thinking there sid is there info on password and login. but in fact they only going to decode

it like Opera 1059 / windows xp 64 bit

[frostymarvelous]

I'm sorry I still don't get it. But its alright.
Hey what happened with your project?

[subzero]

i seem to fit it in quickly so far

[frostymarvelous]

I didn't hear anything.

I mean from you again concerning it.

[leadiztah]

your code is different with this.. hehehe =p RedTeam Labs: Simple Anti Session Hijacking

[subzero]

its like the same with other 5 sites lol

There nothing im hiding here ;)

[arnage]

Does this help somehow? I found it on php.net coments...

<?php
if (isset($_REQUEST['_SESSION'])) die("Get lost Muppet!");
?>

[frostymarvelous]

I think it is checking to see if the hacker tried to pass the session var in a post it get var and then quits the function. I'm not too sure though. Cos that should be PHPSESSID instead.
Well, as I said, I'm not too sure about the snippet. Pardon me if I'm wrong.

[arnage]

function page_protect()
{
session_start();

if (isset($_SESSION['HTTP_USER_AGENT']))
{
if ($_SESSION['HTTP_USER_AGENT'] != md5($_SERVER['HTTP_USER_AGENT']))
{
login();
exit;
}
}
}
function login()
{
session_start();
if(isset($_SESSION['sid']) || isset($_COOKIE['sid'])) {

Enter your sql for your own site !!
}

Not "sid" or "PHPSESSID", thats are the name of _SESSION.

[ori]

doesnt matter what u call your cookie or session vars can be phpsessid or ses or sid or hgchvbgv it really doesnt matter as long as its callled up properly in the script

[subzero]

thats right ori lol

Mine site has cookie_monster_login_(cant say any more here)_And Here lol

Don't matter what you use as long its session being used..

[arnage]

I'm just make a distinction between these two, of course and I said, is irrelevant how it is named... ;)

The question is whether this snippet helps and if placed before or after the session_start() ?

[frostymarvelous]

What is it supposed to do? Thing with copying a snippet is, you don't add the preamble. That makes it weird.
Post the link to the article so we check it out. And btw, you need session start before you can access session vars.