Preventing session conflicts in PHP

Preventing session conflicts in PHP

Recently I stumbled on an interesting bug where entries would show up in our local custom-made ticket system from users that didn't exist in the app. After some poking around I realised that both this and another PHP app running on the same server were using $_SESSION['user'] for authentication purposes. When someone used one system and then opened the other one he was "automatically" logged in as a user from the first app.

After the obligatory facepalm I changed the session variable name in one of the systems to stop this. However I need to make a permanent, zero-maintenance change to my session handling class to avoid this in future projects. I figure this could be done by using a unique value (for example the script path) to put an app's variables in a place in $_SESSION that wont be used by another app.

Is there a better way?

Edit: This is on linux. And both apps are on the same website.

Void value as return parameter


Efficiently record and store page view counts in the database?
You can ensure that the Session cookies will be specific to the application by making sure that the domain and path of the cookies are set restrictively, e.g.

Composite pattern for GTD app
for an application at, you could do the following:.
ASP.NET page content - where does this belong?
<?php  $currentParams = session_get_cookie_params();  session_set_cookie_params($currentParams['lifetime'], '/apppath/', '', $currentParams['secure'], $currentParams['httponly']);  session_start(); 
This will leave the other session settings intact.

Authorization System Design Question
Where should I put the associated methods of a List<T> of datarows?
The path is probably the important one, by default PHP will issue the cookie for the domain that the site was requested over (I think), so you could probably actually leave the domain parameter as the default..
Tag, comment, rating, etc. database design

Develop a network layer protocol in C


Set the cookie path so that each app only stores a session cookie valid for its own path.. You can do this with the session_set_cookie_params call..


When it comes to shared hosting, it's better to store session id in the database rather then storing it on the server, there are lot of materials available on how to store sessions id in the database, more ever periodically changing the logged user session id can also improve securtiy and reduce conflicts..

94 out of 100 based on 44 user ratings 1294 reviews