Is php session unchangeable from user end? [duplicate]

Answer 1

Session() is server side as @kd0807 noted. For more info on Session Hijacking && Fixation:

• http://phpsec.org/projects/guide/4.html
• http://php.net/manual/en/session.security.php

Side note... With the amount of variables I recommend an array for session['user']. example....

$_SESSION['user'] => Array(
'userid'=> '123',
'username'=> 'some_joe',
'role' => 'customer', // user, customer, admin, moderator etc.
'website' => 'http://www.example.com'
);

// reading variables from array
$userid = $_SESSION['user']['userid'];
$username = $_SESSION['user']['username'];
// etc. etc.

Here are 3 very simplified functions I use.

// determine if session has started
Function HasSessionStarted() {

    $result = false; // default to false

    // Check if session has started
    IF ((session_status() == PHP_SESSION_NONE) || (session_id() == '')) { 
        $result = true; 
    }

    return $result;

}

// Set a session value
Function Set_Session($name, $value) {
    /* @params value: can be a string or an array */
    $new_session = HasSessionStarted(); // Check Session Status

    IF ((isset($name)) && (isset($value))) {
        IF ($new_session) { session_start(); }
        $_SESSION[$name] = $value;
        IF ($new_session) { session_write_close(); }
    }

}

Function Unset_Session($name) {

    $new_session = HasSessionStarted(); // Check Session Status

    IF (isset($_SESSION[$name])) {
        IF ($new_session) { session_start(); }
        unset($_SESSION[$name]);
        IF ($new_session) { session_write_close(); }
    }

}