Sessions adding thier own text to my URL?

Arc

I use session_start() at the top of all my pages so i can check for the existance of a session.

For example:

//When the user logs in
 session_start();
    session_register("SESSION");
    session_register("SESSION_UNAME");
    $SESSION_UNAME = $ResultArray[0];

//And then on every other page
session_Start();
If(!empty($SESSION_UNAME))Print "<tr><td valign=\"top\" height=\"30\"><div align=\"center\">$SESSION_UNAME</div></td></tr>";

This works just fine but for some reason when i navigate to a page the damn thing adds a variable to my URL..

Example:
http://www.website.com/index.php?PHPSESSID=6bbd0312fd9c544ed10ac4eac24c3430

Why is it adding that PHPSESSID number to all my URL's?

anyone know? Thanks!
😃

bastien

yeah it can do that...see [man]sessions[/man] the section on trans_sid

ceemac

is there any way to stop it??

bastien

yes. but it involves ensureing that the user accepts cookies

from the manual

Sessions and security
External links: Session fixation

The session module cannot guarantee that the information you store in a session is only viewed by the user who created the session. You need to take additional measures to actively protect the integrity of the session, depending on the value associated with it.

Assess the importance of the data carried by your sessions and deploy addditional protections -- this usually comes at a price, reduced convenience for the user. For example, if you want to protect users from simple social engineering tactics, you need to enable session.use_only_cookies. In that case, cookies must be enabled unconditionally on the user side, or sessions will not work.

hth