How do you hide PHPSESSID?

mdegallier

I've tried setting use_trans_sid in the php.ini file but it doesn't affect anything.

I use <?=SID?> throughout my scripts -- but I thought that would be ignored if use_trans_sid was set to 1 or cookies were handling sessions.

Oh, I'm testing this on WindowsXP/Apache2/PHP4.3
Also need it to work on Unix/Apache/PHP4.3

TIA!

lobobr

Sorry, but I've couldn't understand what exactly you want to know...

Can you please take a moment to clarify what problem you're having?

mdegallier

I'm trying to hide the PHPSESSID string in the URL. Right now all my links create URL's like http://www.domain.com/filename.php?variable=value&PHPSESSID=a8df709a8dfywjk4rb34lryeiufh

This poses problems when people save the URL as a bookmark or the page gets indexed by a search engine.

Thanks for the reply!

Weedpacket

<?=SID?> will be used regardless of the setting of use_trans_sid (all it does after all is echo the value of a particular constant); what use_trans_sid does is put that on all local links if it is not already there.

lobobr

Well, Ive never realized this problem...

Ok, just a wild guess here (totally not tested): what if you set the var $SERVER['PHP_SELF'] or $SERVER['SCRIPT_NAME'] manually after you end processing your commands?

As I've said, this is a wild guess, let me know if you find a solution.

Best regards,

feldon23

If you don't want sessionids in the URL, don't use sessions!

Use cookies.

Weedpacket

Originally posted by feldon23
If you don't want sessionids in the URL, don't use sessions!

Use cookies.

PHP's session-handling already uses cookies if they're available. And if they're not, you can't use cookies. So ... what do you mean?

mdegallier

So, how do you hide the Session ID? I've heard talk about it -- isn't it a problem for search engines? If someone clicks on search engine results that contain old session ids, things can get pretty messed up -- not mentioning insecure.

Maybe there's another method to keeping these from getting indexed?