uatt — Wed, 27 Mar 2002 23:25:38 +0000
well, that is perl and no cookie using preferable...
by the way , no user id registration has been designed for the script..
Mark Hensler — Wed, 27 Mar 2002 18:12:24 +0000
You could use cookies, and save a unique string for identification...
I'm using PHP sessions + $REMOTE_ADDR.
Here is a snippet from my WAHL project. This is taken from my login.php. I am using user/pass, so I tried to take that stuff out.
// prevent people from passing a fake remote_ip
$remote_ip = getenv("REMOTE_ADDR"); 

// . . . . . . . . . 

    // kill previous session
    // use both session ID/IP to make sure that no one else tries to
    //  kill someone elses session
    if ($sid != NULL) {
        $query = "DELETE FROM " . _DBNAME . '.' . _DBTABLE_SESSIONS
                ." WHERE session_id='$sid'"
                    ." AND session_ip='$remote_ip'";
        $result = mysql_query($query);
        if (!$result) {
            Query_Error(__FILE__, __LINE__, $query);
        }
    }


// . . . . . . . 

        
        // get the user's ID
        list($uid) = mysql_fetch_row($result);
            
        // we need to create a unique session ID
        // use a loop to create an ID, and check it against the DB
        // if the ID is found in the DB, set $loop to true
        // if the ID is not found in the DB, set $loop to false
        // if we can't find a unique ID in 10 cycles, stop
        $loop = TRUE;
        $attemp = 0;
        do { //BEGIN while ($loop == TRUE)
            
            // create a random session id
            $sid=md5(uniqid(microtime()));
            
            // check to see if it exists
            $query = "SELECT * FROM " . _DBNAME . '.' . _DBTABLE_SESSIONS
                    ." WHERE session_id='$sid'";
            $result = mysql_query($query);
            if (!$result) {
                Query_Error(__FILE__, __LINE__, $query);
                
                $feedback[] = array(_REPORT_ERROR, "An error occured while trying to find account info");
                
                // break out of the do..while loop
                $break = TRUE;
                break 1;
            }
            
            $num_rows = mysql_num_rows($result);
            
            if ($num_rows == 0) {
                // we've got a unique ID, stop the madness!
                $loop = FALSE;
            }
            else {
                $attemp++;
            }
        } while ($loop == TRUE && $attemp<10);
        
        if ($attemp == 10) {
            $feedback[] = array(_REPORT_ERROR, "An error occured while trying to create session.");
        }
        elseif (!$break) {
            
            // put our new session in the DB
            $query = "INSERT INTO " . _DBNAME . '.' . _DBTABLE_SESSIONS
                    ." SET session_id='$sid'"
                        .", session_ip='$remote_ip'"
                        .", last_action=FROM_UNIXTIME(" . time() . ")"
                        .", user_id='$uid'";
            $result = mysql_query($query);
            if (!$result) {
                Query_Error(__FILE__, __LINE__, $query);
                
                $feedback[] = array(_REPORT_ERROR, "An error occured while trying to create session.");
            }
            
            // set the PHP session_name
            session_name('wahl_session');
            
            // set the PHP session_id
            session_id($sid);
            
            // start the PHP session
            session_start();
            
            // forward to index
            header("Location: index.php?sid=$sid");
            exit;
        }