Session

[volleytotal_ch]

Where are the values of sessions saved? client-side or server-side? and is there a way for users to change the session variable's value?

[OhLordy]

depends how you do it. I like to save them server side, recording the session id and then saving the data in a database table (session data). Then every time a page is loaded check to see if any users have been inactive for a long time and then delete their session data.
HTH
Rob

[volleytotal_ch]

Up to now i was writing all the variables in the $SESSION.
But this might be a security hole and i'm just thinking of changing all that in a "database way".
Just wondering if an user can change the values of $SESSION ...
anybody knows?

[volleytotal_ch]

any ideas ???