My 8th Custom Session Class Revision

[moltendorf]

Hello everyone, this is my first time asking a question in the PHP forum (as I in general am much more experienced in it) instead of where I usually troll around on the JavaScript one.

I am pretty sure this does exactly as I have intended it to do... Control a session...
This script has no errors (I'm pretty sure).

But I just wanted to know if anyone can find a way to "hijack" a session without being on a computer under the same IP address. (Which is possible mostly if that user has cookies disabled, and that user copies the $_GET variable: SID. Whereas you should not be able to do that if the user has cookies enabled, without manually adding/editing your session cookie)

The ONLY way to steal someone's session should be if you're on a computer under the same IP address as that someone.

Note that I haven't added anything to set a user's cookies, this will be added later.

Thanks to everyone who is willing to double-check my code. :)

<code removed as per the posting guidelines>

[moltendorf]

Alright, well, looks like I can't edit my original post, so eh...

Just understand that I threw that up there the moment I finished the majority of the code.

It didn't work (as expected), but now I have a fully functioning one. So just understand that my current version of the code is like that, but working.

[Banfa]

While I understand the sort of euphoria you get when you finally complete a large project/hit a major milestone please bear in mind that our Posting Guidelines contain specific guidelines about posting source code, particularly the source code to course work and stipulate that you may not post the complete source.

I suggest you take a few minutes to read over those guidelines.

Banfa
Administrator

[moltendorf]

Well, I read through them carefully (again), and this is the only thing I have come accross:

Do NOT post your complete source code. Remember, you found this site, so can your professors and tutors and they are likely to take a dim view if you hand in something that appears to be copied from this site. In most academic institutes the minimum response to copying of assignments is a 0 mark for the assignment in question. If you post your entire code your professor will not know it was your work, you may be penalised for copying from yourself.

And well, I thought that I wasn't in any kind of school, or institution, but was rather doing this work on my own terms. So I thought I would ask if anyone thought it was acceptable as a session class.

Yes, this is the full source code for that, but if you saw, there are various references to other classes in other documents I have not included in this page, some of which are much larger. This is only one small dink in my whole program I am developing at the moment.

I guess this just looks like a much more serious form of complete source code that must have been done for coursework rather than for fun like my other posts that looked more like they were for fun such as my shinylink JavaScript?

[Stewart Ross]

Hiya moltendorf. This ain't my forum (I'm away from my Access home) but your reply has caught my eye...

Your original source code was around 80 lines long, and we can't easily review lengthy code submissions. As the guidelines you quote say we cannot show code solutions for courseworks. Anyone can read them, and anyone who copies can end up in serious trouble with their home institution for doing so. In a previous role I chaired disciplinary hearings for students who plagiarised work, so please understand that it is a VERY serious charge to have to face. We cannot in any way encourage the posting of complete solutions that would allow others to copy work.

If you are studying on your own rather than with an institution of some kind we have no way of knowing, so kicking back at our response to you is not going to help.

As I say, not my forum or thread - but the tone of your response caught my eye. All of us who post on this site do so voluntarily to try to help others - please do not be offended if we have to make decisions you don't like. We will not be able to please all posters all of the time...

-Stewart

[moltendorf]

Well, I can understand that, Stewart, but I didn't think of that as I (in general) have always taught myself, and never have thought of school as a place for help, but that's just my personal little tidbit.

A general do not post full source code with no ifs or buts in the guidelines would have steered me away from posting it. (although, it had several parse errors, and problematic bugs, since I wrote it, and did not give it a few test runs before I posted it here)

I guess in general, If I need to give someone the full documentation of the source code, I will have a sort of file browser to look through each huge file on my site in the future (it already exists, but was broken with the recent jump to PHP5).

All I was asking here was someone tell me if it is a good form of security when it comes to that.

One final note. :)
If I ever sound intense or angry in my responses, do not take it in that form, I tend to have that tone when expressing why I did something. So, sorry on that part. I replied in a sense, so I don't lose any "brownie points" for what was an accidental mistake.

If I ever am truly pissed off, I will use ALL CAPS, and on that note will probably be banned from X forum on X date I posted X post (which I assure you, I have never done anywhere except for usually one line in an instant messenger program when I'm instructing someone through editing the registry in Windows and could nearly break their copy of Windows) :)