This problem popped up when somebody who is using my BBS software set up two concurrent instances of the program, working off different databases, on the same machine.
Session variables from one instance "leaked" into another. This created a security hole: If somebody logged into one instance as user ID #3, then changed the URL to point to the other instance of the software, he/she "became" user ID #3 of that database -- even though it might be a different person.
session_name() appears to provide a way to prevent this. I changed my code so that every page calls this:
session_name($db);
... where $db is the name of the database.
Does anybody have enough experience with sessions to verify that this will prevent this problem from occurring again?
