Originally posted by luds
Call me silly..
If you insist ... normally we try and act decent to each other around here 😉
As I understand it, if I use the superglobal arrays, I:
Don't start each page with session_start();
have trans-sid and session-auto-start turned off;
[/list=1][/b]
Hmm, what have you been reading?
Use of the superglobal arrays has very little to do with anything you've mentioned in your list, and as you've found out, the first one is just downright wrong.... Here's a better list:
*Although the developers of PHP have found a better way to refer to session variables since register_globals="on" became deprecated/frowned upon, they still haven't found more than one old and two new(er) ways to tell PHP to use session data: either by calling session_start() during the "headers" section of a script, or by setting session.auto_start=1 in an configuration operation/file, or the old way, starting the session implicitly with session_register().
*session_register() still works, but is basically deprecated because the preferred method is calling session_start() and then assigning values directly to the superglobal SESSION array.
*In order for sessions to work, the server must be able to "stick a virtual name tag" on the client, either by sending a cookie that contains the session ID (SID), or appending the session ID to the query string automatically. If you are masochistic, you can handle the session ID yourself ....
*the most likely real danger from using "trans_sid" is that your grandmother will send your aunt a link that contains her session ID, and your aunt will be able to log in as your grandma, and read correspondance about the will, etc. 😉 If this sort of thing is a concern (and there are situations where it would be) then you should set use session.use_only_cookies instead, and put the fact that users must have cookies enabled in your site's F.A.Q. ....
