using IP# as session id

Anon

Are IP#'s unique to the client or the ISP?

If I were to use $LOCAL_ADDR as the session identifier would I run the risk of having two users with the same sessionID?

rgds,
scott d~

Anon

No - you can't use an IP as a session identifier, because several clients can have the SAME IP (if they use a NAT, a firewall or a proxy). You'll also find some people who have different IP in the same sessions (they are at big companies, who have load-balanced firewalls and can make on user appear as different IP at each pageview).

One thing you can still probably do is use the 2 or 3 first values of the IP 123.123.123.xxx or 123.123.xxx.xxx as a part of your session ID, along with other values.

Anon

Well, What I do for authentication in my scripts is to store the IP and a randomly generated ID, I then do a search on both...

Like Griffon said, there are a lot of companies today that have 1 WAN IP and many internal LAN ip's that are wrapped over the WAN IP using NAT by software or with a router.. and with the advent of broadband connectivity (ADSL, CABLE), more and more companies are doing this... so its ok to use the IP, but ONLY if you use it in conjunction with other values.