Viewing Thread:
"PHPSESSID in source; Security Risk...?"

A little while back I worked on my first logon page for a website, and all seemed to go well. However, checking the source today, when you fire up the logon page initially, after the

tag, PHP adds a hidden form element, which is the PHPSESSID. Although it looks encoded, I don't know if this poses any security risk?

It only appears on the first loading of the page, if I enter incorrect login details and the page reloads telling me the login failed, the extra element is no longer there...

Tried google, but just got a bunch of people moaning that it screwed up their valid xHTML... So evidently I'm not the only one it's happening to, but I was wondering if it actually posed any security risk?

Chars
Sibs

monkey_man wrote:
> Do you need globals on for that?

For session_id() ? No, don't think so.

Do you need globals on for that?

Why are you trying to post the PHPSESSID? You shouldn't need to because you can call it direct from PHP using:


session_start();

$session_id = session_id();

?>

A little while back I worked on my first logon page for a website, and all seemed to go well. However, checking the source today, when you fire up the logon page initially, after the tag, PHP adds a hidden form element, which is the PHPSESSID. Although it looks encoded, I don't know if this poses any security risk?

It only appears on the first loading of the page, if I enter incorrect login details and the page reloads telling me the login failed, the extra element is no longer there...

Tried google, but just got a bunch of people moaning that it screwed up their valid xHTML... So evidently I'm not the only one it's happening to, but I was wondering if it actually posed any security risk?

Chars
Sibs