Jump to content

Session Security


jaymc

Recommended Posts

Right, Im just wondering how much I can rely on the security of SESSIONS

On my site, I use a lot of $_GET which is obviously an ideal opportunity for hackers to code inject

However, When querying or updating mysql, I also use the following method

[code]$user = $_SESSION['user'];
$query = "SELECT * FROM `members` WHERE `username` = $user LIMIT 0,1"[/code]

As you can see, it will only query the row that has a username equal to $user

[b]
Now, what are the chances of a hacker spoofing the session to make it equal what ever they want[/b]
Link to comment
Share on other sites

They wont.

As the session is stored on the server and not on the client. The only way for a hacker to spoof a session is by getting a valid session id. In order to get the session id they need to be in the same room as you.

Also about $_GET you should be validating the input not use raw GET data.
Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.