1 透過SessionID維護網站中的使用者資訊
session_start();
$_SESSION['visits']++;
print'You have visited here '.$_SESSION['visits'].' times.
';
echo'session id = '.$_COOKIE['PHPSESSID'];
echo"
";
echo"session name = ".session_name()."
";
?>
SessionID記錄在全域變數_COOKIE中,SessionID的名字是PHPSESSID,PHPSESSID也可以透過session_name()取得。
2 預防Session劫持
ini_set('sessio.use_only_cookies', true);
session_start();
$salt = 'YourSpecialValueHere';
$tokenstr = date('W').$salt;
$token = md5($tokenstr);
echo'token = '.$token.'
';
if(!isset($_REQUEST['token']) || $_REQUEST['token'] != $token)
{
exit;
}
$_SESSION['token'] = $token;
output_add_rewrite_var('token', $token);
echo'link';
ob_flush();
output_reset_rewrite_vars();
?>
session_start();
output_add_rewrite_var('var', 'value');
echo'link';
ob_flush();
output_reset_rewrite_vars();
echo'link';
?>以上例程会输出:
<ahref="file.php?PHPSESSID=xxx&var=value">linka><ahref="file.php">linka>
3 預防Session定制