I am creating a social media website which is expected to have huge traffic. PHP version is 7.3, session_set_save_handler is MYSQL database. cookie_lifetime is set to one year I am concerned about the fact that PHP session_start() could generate duplicate session_id(ie same session_id for multiple users) in high traffic sites, though the probability is too low. I have searched a lot but haven't come across a fool proof algorithm to avoid it. Can anybody here enlighten me about the same?
37433
How unique is the php session id? I got the impression from various things that I've read that I should not rely on two users never getting the same sessionid. Isn't it a GUID?
37007
I use a script that generates a session name for out AS400 sessions based on the system %username%, the problem is that if the username is over 7 characters long the connection will fail. The session names get one character appended and the connection supports a total lengh of 8 characters.  Any ideas?
91888
When I do a single row INSERT to a table that has an AUTO_INCREMENT column I'd like to use the LAST_INSERT_ID() function to return the new AUTO_INCREMENT'ed value stored for that row.  As many Microsoft SQL Server devs and admins no doubt are aware the equivalent functionality in SQL Server (SCOPE_IDENTITY and @@IDENTITY) hasn't been .  I know the MySQL docs state:     The ID that was generated is maintained in the server on a per-connection basis. This means that the value returned by the function to a given client is the first AUTO_INCREMENTvalue generated for most recent statement affecting an AUTO_INCREMENT column by that client. This value cannot be affected by other clients, even if they generate AUTO_INCREMENT values of their own. This behavior ensures that each client can retrieve its own ID without concern for the activity of other clients, and without the need for locks or transactions.     and even go so far as to say:     Using LAST_INSERT_ID() and AUTO_INCREMENT columns simultaneously from multiple clients is perfectly valid.     Are there any known risks or scenarios that may cause LAST_INSERT_ID() not to return the correct value?  I'm using MySQL 5.5 on CentOS 5.5 x64 and Fedora 16 x64 and the InnoDB engine.
58273
I know that php has md5(), sha1(), and the hash() functions, but I want to create a hash using the MySQL PASSWORD() function.  So far, the only way I can think of is to just query the server, but I want a function (preferably in php or Perl) that will do the same thing without querying MySQL at all.  For example:  MySQL hash -> 464bb2cb3cf18b66  MySQL5 hash -> *01D01F5CA7CA8BA771E03F4AC55EC73C11EFA229  Thanks!
96725
sniffs the network looking for session id's and makes it very easy for an attacker to hijack this authenticated session. It should be noted that Firesheep is nothing new ; it just makes this attack very easy. Many websites like Facebook (EDIT: Actually Facebook has patched this vulnerability) and Stack&nbsp;Overflow violate . A user can protect themselves by using a plugin like , but stackoverflow.com doesn't even have a valid certificate. Thus it is trivial to   and users have no way of protecting themselves.  Does the Stack&nbsp;Overflow team not understand the threat of OWASP A9? Do they not care enough to spend the $20 on a certificate to give users the option to protect themselves? Google has not experienced a significant increase in resource consumption by switching to HTTPS. At least give people the option to secure themselves.      Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10&nbsp;KB of memory per connection and less than 2% of network overhead.    Source:
83865
I have an app using PHP and the PayPal API. The basic way it works to get a payment is that you do a web service call to PayPal to get a token and then do a browser redirect to PayPal with that token for the user to pay. After the payment details have been confirmed, PayPal redirects back to the URL you originally set in the service call.  This all works, millions of people use it every day, et cetera.  Strange thing is, when PayPal redirects back, the PHP session is gone. It's a .  First question: why is this happening? Both pages are on the same domain, both use HTTPS. The session works for all requests up until the PayPal redirect back.  The linked forum thread suggests a workaround, to persist the session ID in the PayPal request and then to retrieve it later and restore the session. Great, except it doesn't seem to work.  I can add some log statements:  log(session_id());   before and after the various redirects. When coming back from PayPal, I log some more.  log("session id is " . session_id()); $session_id = get_session_id_from_paypal(); log("setting it back to " . $session_id); session_id($session_id); session_start(); log("session id is now " . session_id());   The result is not at all what I'd expect:     session_id is fc8f459a186a3f4695ff9ac71b563825   setting it back to 82460dcf8c8ddd538466e7cb89712e72   session_id is now 360ba3fd99d233e0735397278d2b2e55     Second question: why is the session id not at all what I set it to? What am I doing wrong? Or, at least, why do none of the session variables come back?
48096
While it's great to have the ability to clear all session cookies for all devices, I'd like the ability to log out on one computer only, and not come home to have to relogin on all of my devices. It can really be a pain.   Is there a technical reason we don't have this, or why don't we?
99639
We got multiple small websites (microsites) and one main high traffic one with big users base. Right now the requirement is to build authentication system which should allow users to loign with the same identity across the network.  All website are running on different domains, powered by Drupal 6 CMS and have separate databases (so sharing tables with prefix is not an option + it creates a huge mess in the db).  Here is the set of core requirements I came up with:   Users should be able to login with the same credentials to all sites within the network User’s data sharing between Main site (storage) and all micro sites within the network Data synchronization across the network when user changes the data (update email or password for example) The login/registration process should be seamless and consistent Register on any of the sites across the network and use that identity to login later on.   In the future there might be a need to add openid authentication options.  Basically we are looking at something similar stackexchange does, but not sure if they have central users base on not.  I was thinking about custom solution which will include 2 parts (modules), one will be stored on the Main site for users data storing and responding to requests from clients. Second part (module) will be placed on each microsite, which is going to send requests to the Master. Some kind of client - server setup.  One of the complications I see right away is #3. Data Synhcronization across the network.  I just don't want to reinvent the wheel and maybe some work is already done in this direction.  Looking forward to your ideas on how to approach this project.  EDIT:  Recently I've found couple related threads on the topic:
9042
I am very new to Linux and I've only been using it to SSH to my web server using Putty. The issue I am having is this:  Basically I've got 2 php scripts. One get_tweets.php constantly listens for tweets on twitters Streaming API whilst the other - parse_tweets.php logs these into a db. In order for these to work they've to be kept running continuously.   I've been using the following commands to run them in the background and from what I've seen they run for most of the day, however whenever I log on to my computer in the morning the scripts have stopped and I've to run commands again.  nohup php my_script.php &gt; /dev/null &amp;   I'm just wondering if that is normal based on the commands I am using, should they run indefinitely when using nohup and if not what is the alternative? A CRON job?  Thanks for the help
48920
Since the  to the close as duplicate mechanism it is a lot more visible to the OP that there is/might be a duplicate to their question. Empirically, I've noticed a lot more people agreeing, in the comments under their question, that their question is a dupe.   For instance, :        I'm aware that allowing  is  (back in the stone age) but now Stack Exchange is so much larger, and Stack Overflow is groaning under the weight of questions, I think this should be partially revisited.  Based on the principle that the simplest way to keep a site clean is to have as many people as possible nibbling away, I propose that the OP gets granted a binding close-as-duplicate vote.  It should simply be an additional line in the banner, which is . It might be something like this:     This question may already have an answer here:   &nbsp; "" 3 answers   &nbsp; Does this fully answer your question?  Yes / No   I'm not wedded to the Yes / No thing I just can't think of a better way at the moment.  Clicking on Yes would take the OP to the close as duplicate dialogue with that question highlighted. If there are multiple duplicate questions you'd need to ask the OP multiple times. A No could be used to track the relative success of the project, i.e.   Whether the question subsequently gets closed. Whether the question gets reopened again. How many times the OP actually clicks. How many times the OP disagrees with the analysis of the community.   Potentially, a No could be used to open a comment dialogue asking the OP to explain why they think their question is not a duplicate thereby stopping them simply putting "this is not a duplicate" in the question and formalising this process somewhat. Not sure about this idea...  I do not think this should be restricted by reputation, anyone should be able to close their own question as a duplicate. It gives people with lower reputation a more positive experience of the closing process and emphasises the importance of duplicate finding.  Most importantly, self-closes should not, initially, count towards the question ban. We can help new users learn how to use a lot more of the site than they might otherwise see and encourage them to search for duplicates more thoroughly. If the OP then goes on to do the same thing 10 times in a row then you can start using it toward the ban as they're obviously using the users as a personalised search service but at least the first 3-4 times this should not have any effect.  This question is, deliberately, only requesting 20% of the linked question (from 2009) and then only based on the new UI. The linked question asks for binding migration votes etc, which I do not want to see and I am not requesting a binding close-as-duplicate for the OP until someone else has already voted to close (though I think if the OP has 3k rep this might be allowable). This, I hope, addresses the concern's raised in the linked question and explains why this is not a duplicate of that question.
115248
There are some protocols that require the user to generate some random key locally (client-side) with no server authority to "approve" or "reject" their key and are based on the assumption that it's extremely unlikely that two user will come up with the same key. Bitcoin is one of these.  What's the probability for two different users to come up with:    The same randomly-generated 128-bit string. The same randomly-generated 256-bit string. The same randomly-generated 2048-bit RSA key. What's the probability that two user will have the same 128/256 bit hash of their public key, because of a hash collision?   How all compare to Bitcoin?
26365
I'm creating a web directory that will allow individual users to signup for an account and store essentially text documents in a mysql database entry.  Initially there will likely be only a few hundred users, but we hope to have 10,000 to 100,000 at some point.  And each user would be able to upload 100-200 "documents".  Would it be more efficient to create one massive table, indexed by a user number?  Which could theoretically grow to be 20,000,000 entries.  Or to go ahead and create a table for each user with their individual documents?  I'm assuming it's not healthy to have thousands of tables in a database, but I really can't find any concrete data on this.
100386
I know that in the end it, can't be done.  But, what are the options to:    &nbsp; a) limit the options for persons to create multiple accounts, &nbsp; b) increase the chance of detecting multiple accounts / person    for a blog-like web service? (people can sign up for their own blog)  Update: I think the 'limit the options' has been answered nicely. (there is no reliable method, but we can raise the bar) However, I would still like to know what other options there are to detect multiple accounts?
50568
Suppose I have a table with an auto_increment column, and then insert multiple values in a single statement:  insert into foo (bar) values ('a'), ('b'), ('c');  From the documentation, last_insert_id() returns the first generated ID for the query, the ID for a in this case.  Does mysql give any guarantees that a b and c will then be assigned sequential values?  In other words, if last_insert_id() returns 1 for a, is there any guarantee that b = 2 and c = 3? Or could there be a scenario where due to multiple concurrent inserts, I could end up with something like "a = 1, b = 5, c = 9"?
87186
For the following pretty straightforward task: query a list of products from a DB and present it on a webpage, consider 2 setups:  Setup1: PHP script queries. All content is built on the server and the entire page is served back to the client.  Setup2: Static HTML "page skeleton" requesting content using AJAX. Received content is parsed on the client side using Javascript and rendered using innerHTML or similar.  Of course the second setup only makes sense when you have pages, categories and tags for the client user to choose from.  I need to compare these two, at least by means of:   time it will take content to be served user experience (setup1 is delivered as a whole, setup2 is delivered in "two parts") scalability - how do the setups compare when I have 100,000 queries daily   Any thoughts on the issue will be much appreciated.
25460
I'm wondering why WordPress does not support sessions and many people out there claim that putting the following code in functions.php might not be a good idea (it in fact works for me but returns PHP warnings, too):  function cp_admin_init() { if (!session_id()) session_start(); }  add_action(‘init’, ‘cp_admin_init’);   Is it good idea to enable sessions in WordPress? What would be the correct way to do this?
90059
The description says "share a link to a question on social media that gets 5 clicks".  I've tweeted a question that got over 5 clicks. I've posted a share link in chat that also got over 5 clicks. Both of these had my user ID number in it and were clicked by different people.  I watched in real life as the twitter link was clicked, by family and friends, on different computers each time. It's not a problem of the same IP.  (no wifi network overlap either)  Why haven't I gotten the hat? For the record, it's been almost an hour by now, so it's not hat lag causing the problem.  To clarify: the clicks were opening the share link in the browser, which redirected to the full url.