phplib-users — A list for users of phplib to talk / discuss phplib

[Phplib-users] Select Box!

[Marylly A. S. <ima...@ya...>]

hello guys

Can I create a select box and create the options using a select from the 
database?

thanks

Marylly
**Mya**

Re: [Phplib-users] While + Mysql

[Joerg B. <be...@ta...>]

Marylly Araujo Silva schrieb:
> Hello guys
> 
> I'm new in the list and I want to know how I could use "while" to see 
> the rows from tables of my db without using the command show_results().

do you mean something like that?

while($db->next_result()){
   echo $db->f('column1').'<br/>';
   echo $db->f('column2').'<br/>';
   ...
}


regards
Joerg

[Phplib-users] While + Mysql

[Marylly A. S. <ima...@ya...>]

Hello guys

I'm new in the list and I want to know how I could use "while" to see 
the rows from tables of my db without using the command show_results().

Thanks

marylly
**Mya**

[Phplib-users] Re: Propagate $sess, $auth to a function

[<ed...@gm...>]

Sorry, it works just making $auth global. Sorry, until now I haven't
realized that I was calling the function before calling open_page, so
the $auth variable was not created yet.

;)

Eduardo Alfonso



On Fri, 18 Mar 2005 20:12:54 -0500, Eduardo Andr=E9s Alfonso Sierra
<ed...@gm...> wrote:
> Hi, It's me again here learning phplib.
>=20
> Now, my problem is this way.
>=20
> From a normal script, I mean, from a php page accessed by a user I
> call a function that I developed.
>=20
> I need in that function access the authentication and session
> infromation. For example, I want in that function to know the
> authenticated user name to send an e-mail or something.
>=20
> Is any posibility to "propagate" these variables ($sess, $auth for exampl=
e) ??
>=20
> I tried many ways, declaring it globals and several more and never got th=
e goal.
>=20
> The only way I've been able to do that is passing these data as
> parameter to the function. I really don't like that solution, I think
> there must be some, "more natural" way to do that, I think it's just
> to tell the function to use the "environment" or request information
> of the calling page but have no idea on doing that.
>=20
> Any ideas ??
>=20
> Thanks again, and again
>=20
> Eduardo Alfonso
>

[Phplib-users] Propagate $sess, $auth to a function

[<ed...@gm...>]

Hi, It's me again here learning phplib.

Now, my problem is this way.

From a normal script, I mean, from a php page accessed by a user I
call a function that I developed.

I need in that function access the authentication and session
infromation. For example, I want in that function to know the
authenticated user name to send an e-mail or something.

Is any posibility to "propagate" these variables ($sess, $auth for example) ??

I tried many ways, declaring it globals and several more and never got the goal.

The only way I've been able to do that is passing these data as
parameter to the function. I really don't like that solution, I think
there must be some, "more natural" way to do that, I think it's just
to tell the function to use the "environment" or request information
of the calling page but have no idea on doing that.

Any ideas ??

Thanks again, and again

Eduardo Alfonso

Re: [Phplib-users] Logged user on an unsecured page

[<ed...@gm...>]

Andreas

Once again, thanks for your help. I found that phplib has somithing
that works for what I wanted. It is the nobody flag that Auth
supports. Creating a subclass of Auth (really subclass of MyAuth) and
declaring the nobody flag as true, phplib "will not create a login
screen to force a user to authenticate, but will authenticate the user
silently as nobody". It worked great for me, it solves the problem
(probably not the best way).

Here's what the documentation describes:
"Many applications want to use $auth and $perm objects to protect
functionality on a page, but do want to make the unprotected part of
this page available to users with no account. This presents a kind of
dilemma, because you need $auth and $perm objects to protect
functionality on a page, but you don't want a login screen to appear
by default.

Default authentication solves this dilemma by providing a special uid
and uname "nobody", which is guaranteed to fail every permission
check. If you set the nobody flag, $auth will not create a login
screen to force a user to authenticate, but will authenticate the user
silently as nobody. The application must offer a login button or other
facility for users with accounts to change from that id to their real
user id."

I just found a problem with that solution. Due to the fact that the
application "will authenticate the user silently as nobody", the user
browsing the site is, in fact, authenticated. That creates a problem
when going from an unsecured page to a secured one because the system
has an authenticated user without any privileges. That's a problem,
for example, showing a menu that is customized based on user roles or
permissions. So, I needed to "logout" the nobody user at the end of
the unsecured page (or secured unedr nobody Auth class), to force
authenticate him when going to a really secured page.

That logout at the end of every unsecured page must be a "special"
logout. It cannot be a "normal" logout because the user authenticated
on a secured page would get logged out to if go, for any reason, to
the unsecured page. So, I must also overrides the normal logout to a
special logout, that really performs the logout process, only if the
current authentication corresponds to nobody authentication.

It's easier that it sound and it works great.=20

So, the final solution was to secure the unsecured page using the Auth
sub-class with the nobody flag activated and perform a "special"
logout at the end of the unsecured page.

Once again, it works great but it's probably not the best solution.

Thanks again Andreas




On Fri, 18 Mar 2005 22:23:12 +0100, Andreas Israel <an...@sp...> wr=
ote:
>=20
> Hello Eduardo,=20
>=20
> AFAIK there is no feature like this in the lib. I Have 3 ideas:=20
>=20
> 1. login_table=20
> * create a new table with user_id, login_time (timestamp), sess_id=20
> * extend the auth class method auth_validatelogin() method -->write=20
> logindata into this new table the data if login is successful=20
> * extend the logout features in a similar way like above=20
> * write an analyse function/class for the data=20
> ** join the sessions table on sess_id and the user_table on user_id=20
> *** gets logintime from the new table, and last "action" time from=20
> session table and username from user_table=20
> -->maybe this will produce some "dead" database entries, because of=20
> users not logged out and sessions garbage_collection=20
>=20
> 2. inspired by phpslash (http://sourceforge.net/projects/phpslash/)=20
> -->similar procedure as above, but in phpslash there is still a function=
=20
> logwrite('LOGITEM', 'LOGDATA (browser, ip, whatever you wish)')=20
> --->maybe this is not reliable, for timed out sessions=20
>=20
> 3. usage of phpopentrackers (http://phpopentracker.de/en/index.php)=20
> current_activity feature=20
> * of course phpopentracker is a powerful tool, which can log much more,=
=20
> but it is possible to setup what to log=20
> ** extend the auth class and log only if auth_validatelogin is successful=
l=20
> -->this is easy to implement, but not really reliable, because=20
> current_activity times out after 3 minutes=20
> -->the advance of this idea is, you know there your users are=20
> I think a mixture of 1 and 2 is best.=20
>=20
> Have fun=20
>=20
> Andreas=20
>=20
> PS: maybe this feature is worth to put into cvs, when it is approved an=
=20
> tested :)=20
>=20
> Eduardo Andr=E9s Alfonso Sierra schrieb:=20
>=20
>=20
> Hi=20
>=20
> For logging purposes I want to know who's logged on my system even on=20
> an unsecured page. Is it possible ?? How do I do that ??=20
>=20
> I've tried many way but the $sess, $user and $auth variables are never=20
> recognized on unsecured pages.=20
>=20
> How should I salution that ?=20
>=20
> Thanks in Advance=20
>=20
> Eduardo Alfonso=20
>=20
>=20
> -------------------------------------------------------=20
> SF email is sponsored by - The IT Product Guide=20
> Read honest & candid reviews on hundreds of IT Products from real users.=
=20
> Discover which products truly live up to the hype. Start reading now.=20
> http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick=20
> _______________________________________________=20
> Phplib-users mailing list=20
> Php...@li...=20
> https://lists.sourceforge.net/lists/listinfo/phplib-users=20
>=20
>  =20
>=20
>=20
>=20
>=20
>=20
>

Re: [Phplib-users] Logged user on an unsecured page

[Andreas I. <an...@sp...>]

Hello Eduardo,

AFAIK there is no feature like this in the lib. I Have 3 ideas:

1. login_table
* create a new table with user_id, login_time (timestamp), sess_id
* extend the auth class method auth_validatelogin() method -->write
logindata into this new table the data if login is successful
* extend the logout features in a similar way like above
* write an analyse function/class for the data
** join the sessions table on sess_id and the user_table on user_id
*** gets logintime from the new table, and last "action" time from
session table and username from user_table
-->maybe this will produce some "dead" database entries, because of
users not logged out and sessions garbage_collection

2. inspired by phpslash (http://sourceforge.net/projects/phpslash/)
-->similar procedure as above, but in phpslash there is still a function
logwrite('LOGITEM', 'LOGDATA (browser, ip, whatever you wish)')
--->maybe this is not reliable, for timed out sessions

3. usage of phpopentrackers (http://phpopentracker.de/en/index.php)
current_activity feature
* of course phpopentracker is a powerful tool, which can log much more,
but it is possible to setup what to log
** extend the auth class and log only if auth_validatelogin is successful=
l
-->this is easy to implement, but not really reliable, because
current_activity times out after 3 minutes
-->the advance of this idea is, you know there your users are
I think a mixture of 1 and 2 is best.

Have fun

Andreas

PS: maybe this feature is worth to put into cvs, when it is approved an
tested :)

Eduardo Andr=E9s Alfonso Sierra schrieb:

> Hi
>
> For logging purposes I want to know who's logged on my system even on
> an unsecured page. Is it possible ?? How do I do that ??
>
> I've tried many way but the $sess, $user and $auth variables are never
> recognized on unsecured pages.
>
> How should I salution that ?
>
> Thanks in Advance
>
> Eduardo Alfonso
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick
> _______________________________________________
> Phplib-users mailing list
> Php...@li...
> https://lists.sourceforge.net/lists/listinfo/phplib-users
>
> =20
>

[Phplib-users] Logged user on an unsecured page

[<ed...@gm...>]

Hi

For logging purposes I want to know who's logged on my system even on
an unsecured page. Is it possible ?? How do I do that ??

I've tried many way but the $sess, $user and $auth variables are never
recognized on unsecured pages.

How should I salution that ?

Thanks in Advance

Eduardo Alfonso

Re: [Phplib-users] Securing Frames

[Andreas I. <an...@sp...>]

Hello Eduardo,

there is a german article at:=20
http://go4xml.com/kurs/php/faq/faq-phplib.php#phplib-12
from kristian koehntopp (one of the authors of the "old" phplib)
there he recommends to not page_close(), if the session_data doesn't get=20
changed.

there is also an old thread at:
http://www.phpbuilder.com/lists/phplib-list/2000102/0110.php
http://www.phpbuilder.com/lists/phplib-list/2000062/0052.php
with some thoughts to work around.
but it seems so, that the best way is not to use frames. ;(

HTH

Andreas

Eduardo Andr=E9s Alfonso Sierra schrieb:

>Hi
>
>I have a site and its principal page contains frames. The left frame
>shows the menu and the right the contents.
>
>I require authentication on the menu page like this
>
>page_open(array ("sess" =3D> "SystemSession", "auth" =3D> "SystemAuth",
>"perm" =3D> "SystemPerm"));
>
>But it shows the login page on that frame. Then I tried to put the
>authentication on the frames page and now it works as I wanted, that
>is, showing the login page on the whole browser page, but it still
>asking me for login on the menu frame. How can I do to propagate the
>authentication on the principal page to the menu page ??
>
>Thanks in advance !
>
>
>-------------------------------------------------------
>SF email is sponsored by - The IT Product Guide
>Read honest & candid reviews on hundreds of IT Products from real users.
>Discover which products truly live up to the hype. Start reading now.
>http://ads.osdn.com/?ad_id=3D6595&alloc_id=3D14396&op=3Dclick
>_______________________________________________
>Phplib-users mailing list
>Php...@li...
>https://lists.sourceforge.net/lists/listinfo/phplib-users
>
> =20
>

[Phplib-users] Securing Frames

[<ed...@gm...>]

Hi

I have a site and its principal page contains frames. The left frame
shows the menu and the right the contents.

I require authentication on the menu page like this

page_open(array ("sess" => "SystemSession", "auth" => "SystemAuth",
"perm" => "SystemPerm"));

But it shows the login page on that frame. Then I tried to put the
authentication on the frames page and now it works as I wanted, that
is, showing the login page on the whole browser page, but it still
asking me for login on the menu frame. How can I do to propagate the
authentication on the principal page to the menu page ??

Thanks in advance !

Re: [Phplib-users] Problems with German charakters

[Joerg B. <be...@ta...>]

----- Original Message ----- 
From: <as...@0u...>
To: <php...@li...>
Sent: Thursday, February 17, 2005 7:07 PM
Subject: [Phplib-users] Problems with German charakters


> I moved all my php-Sites to another server. Even all the databases.
> Everything works fine after doing some fine tuning. The only problem
> appears when printing data from my mysql-tables. I get some wrong characters,
> although the correct values are saved in the database fields.

> For example: 'Mädchen' is shown as 'M?hen'
>              'für Eltern' is shown as 'f?ern'

Sound offtopic for me. :|

Check the webserver config if there is a  UTF8 Charset header is on default. This can be happens on
apache2 stock installations. Check also the charset settings from your database.

regards
Joerg

-- 
TakeNet GmbH   Mobil: 0171/60 57 963
D-97080 Wuerzburg  Tel: +49 931 903-2243
Alfred-Nobel-Straße 20  Fax: +49 931 903-3025

[Phplib-users] Problems with German charakters

[<as...@0u...>]

I moved all my php-Sites to another server. Even all the databases.
Everything works fine after doing some fine tuning. The only problem
appears when printing data from my mysql-tables. I get some wrong characters,
although the correct values are saved in the database fields. 

For example: 'M=E4dchen' is shown as 'M?hen'
             'f=FCr Eltern' is shown as 'f?ern'


Any ideas?

Thanks so far, Andi

[Phplib-users] session.bug_compat_42 Warning

[Andrew C. <sou...@ev...>]

I recently tried switching an app to PHP4 sessions and am getting an odd 
warning:

Warning: Unknown(): Your script possibly relies on a session side-effect 
which existed until PHP 4.2.3. Please be advised that the session 
extension does not consider global variables as a source of data, unless 
register_globals is enabled. You can disable this functionality and this 
warning by setting session.bug_compat_42 or session.bug_compat_warn to 
off, respectively. in Unknown on line 0

The phplib files I am using are from CVS in late December, 2004.

I was under the impression that session4.inc, session4_custom.inc, 
page4.inc, prepend.php, and local4.inc were drop-in replacements for 
their PHP3 counterparts.  Am I missing something?

I read a bunch of stuff that came up on a Google search for the error 
and it seems to be related to using session_register and $_SESSION in 
the same script.  I'm not calling either, directly, just relying on 
phplib ($sess->register("somevar")).

It doesn't seem to matter if I have register_globals on or off.

Any idea what I've got screwed up?  Or is this a phplib bug?

Andrew

[Phplib-users] What's the Cache?

[Andrew C. <sou...@ev...>]

Greetings,

I'm having a really odd problem with a phplib-based application and am 
wondering if anyone else has seen this before.

The system uses phplib templates, database abstraction, and 
authentication and, generates a long listing of database records (about 
650 rows, currently) after authentication.  It takes a little under 20 
seconds after the request for the server to generate and send the page.

I have tried to get them to let me break the output into pages but, they 
like having the full listing all at once.

There are over a hundred users.  For most of them, everything works 
great.  For a handful of them - maybe a dozen - there is some kind of a 
weird caching problem.  They authenticate and, after the standard load 
time, end up with a blank page.  They can view other pages (like the 
User Administration page) with no trouble.

I had a chance to look at one of the problem systems first-hand this 
past week.  The user has two identical Compaq notebooks, running Windows 
XP.  All current patches are installed on both of them.  One system 
works perfectly and the other exhibits the problem.  I also connected my 
own notebook and had no trouble accessing the system.  So, it doesn't 
seem to be connection-specific.

After authentication, the problem system loads for about 20 seconds and 
then displays the blank page.  If we do anything to the URL while the 
blank page is displaying - remove the index.html from the end of the URL 
string or, add a query string - the listing appears instantly (from 
cache, presumably), even when it shouldn't (like when the query string 
tells it to display something else).

This happens in both IE and Mozilla.  According to the page info in 
Mozilla, the page is loading from disk cache.  Both browsers have been 
set to check the server for updated versions on every visit.

The problem systems seem to be able to load pages on other websites 
(even from the same server) with no issues.

Anybody have any idea what the problem might be and how to address it? 
I'm guessing a full system re-install would correct it but, that's going 
to be very unpopular and likely unworkable for most of the troubled users.

Andrew Crawford

[Phplib-users] oohforms.inc - W3C standard?

[Frank B. <fb...@sy...>]

Is oohforms striving for HTML 4.01 Transitional?  If so, the line in 
oohforms.inc:
       $str .= "<script language='javascript'>\n<!--\n";
needs to change to:
       $str .= "<script language='javascript' type='text/javascript'>\n<!--\n";

If I mix tables and forms on the same page, I have figured out that if the 
page is a single form, then $f->start() precedes <table> and $f->finish 
follows </table>.
When each row in a table is a separate form, where do these functions get 
called relative to <tr></tr>?

Frank

Re: [Phplib-users] PHP Notice: oohforms

[Frank B. <fb...@sy...>]

At 10:22 AM 1/8/05, Frank Bax wrote:

>At 07:38 AM 11/18/04, Frank Bax wrote:
>
>>At 11:38 AM 11/17/04, Jeremy Weathers wrote:
>>
>>>Quoth Frank Bax:
>>>
>>> > > > PHP Notice:  Undefined index:  Kill - line 21
>>> > >
>>> > >I can't find this in the oohforms files - this might be in your code.
>>> >
>>> >
>>> > Sorry, missed this sentence yesterday.  It's definitely inside
>>> > oohforms.inc - my form has several "submit" buttons - one each for
>>> > "Add", "Chg", "Del".  Whenever one of them is clicked, I get the
>>> > above error for each of the form elements where type="submit", except
>>> > the one that was clicked.
>>>
>>>
>>>So, in the case you originally reported, the name of the submit button that
>>>caused the error was "Kill"? I'll take a peak and see if I can find the
>>>problem.
>>
>>
>>Yes, that's the "name" of one of the submit buttons.
>
>
>Never mind.  I looked at my code a little closer as I cloned it for a new 
>form this week.  It seems I didn't know anything about classes at the time 
>of coding the original.  When I converted:
>
>   function FormOne( &$f, $oid ) {
>     $f->add_element(array(
>                         'type'          => 'hidden',
>                         'name'          => 'oid',
>                         'value'         => $oid,
>                         ) );
>   }
>     $f = FormOne(new form, $f, $oid);
>
>to:
>
>   class FormOne extends form {
>     function FormOne( $oid ) {
>       $this->add_element(array(
>                         'type'          => 'hidden',
>                         'name'          => 'oid',
>                         'value'         => $oid
>                         ) );
>     }
>   }
>   $f = new FormOne( $oid );
>
>The problems at line 21 of oohforms.inc disappeared.
>
>Frank


I hate when this happens. $f->validate() was missing in my new code.  When 
I put it back in, the notices came back. 

Re: [Phplib-users] PHP Notice: oohforms

[Frank B. <fb...@sy...>]

At 07:38 AM 11/18/04, Frank Bax wrote:

>At 11:38 AM 11/17/04, Jeremy Weathers wrote:
>
>>Quoth Frank Bax:
>>
>> > > > PHP Notice:  Undefined index:  Kill - line 21
>> > >
>> > >I can't find this in the oohforms files - this might be in your code.
>> >
>> >
>> > Sorry, missed this sentence yesterday.  It's definitely inside
>> > oohforms.inc - my form has several "submit" buttons - one each for
>> > "Add", "Chg", "Del".  Whenever one of them is clicked, I get the
>> > above error for each of the form elements where type="submit", except
>> > the one that was clicked.
>>
>>
>>So, in the case you originally reported, the name of the submit button that
>>caused the error was "Kill"? I'll take a peak and see if I can find the
>>problem.
>
>
>Yes, that's the "name" of one of the submit buttons.


Never mind.  I looked at my code a little closer as I cloned it for a new 
form this week.  It seems I didn't know anything about classes at the time 
of coding the original.  When I converted:

   function FormOne( &$f, $oid ) {
     $f->add_element(array(
                         'type'          => 'hidden',
                         'name'          => 'oid',
                         'value'         => $oid,
                         ) );
   }
     $f = FormOne(new form, $f, $oid);

to:

   class FormOne extends form {
     function FormOne( $oid ) {
       $this->add_element(array(
                         'type'          => 'hidden',
                         'name'          => 'oid',
                         'value'         => $oid
                         ) );
     }
   }
   $f = new FormOne( $oid );

The problems at line 21 of oohforms.inc disappeared.

Frank 

Re: [Phplib-users] Problem with login after upgrading to PHP 4.3.10

[Mike G. <mi...@op...>]

It's using session4,

Don't think it is the latest CVS version, but it's from the last year I 
believe..  It isn't from a default release..

Sorry I don't have more details..  It's all bundled together in our CMS

You can grab the latest snapshot from here:
	http://back-end.sourceforge.net/snapshots/

Mike

On 22-Dec-04, at 10:09 AM, marko wrote:

> Hi Mike,
>
>> Just a quick note to say that I haven't had this problem since we've
>> upgraded.
> Good to know. Which phplib-version do you use?
>
> Do you use session4? Or even the custom version?
>
> Marko
>
--
Mike Gifford, OpenConcept Consulting
Free Software for Social Change -> http://www.openconcept.ca
Campaigns using our software - http://solidarity.indymedia.org.uk
http://unitedforpeace.org/petition/?id=1  and  http://marryanamerican.ca

Re: [Phplib-users] Problem with login after upgrading to PHP 4.3.10

[marko <mk...@mc...>]

Hi Mike,

> Just a quick note to say that I haven't had this problem since we've
> upgraded.
Good to know. Which phplib-version do you use?

Do you use session4? Or even the custom version?

Marko

Re: [Phplib-users] Problem with login after upgrading to PHP 4.3.10

[marko <mk...@mc...>]

Thanks for your response Andrew. So it looks like I need to use the latest
release of phplib from CVS, if it's that what you're using. I didn't use
that version because I had trouble setting it up for my needs and instead
used another snapshot version made available by Joe Stewart (if I remember
well). That worked fine for me all the time... But it looks like I have to
go for the official release then...
Thanks again,
Marko

[Phplib-users] Problem with login after upgrading to PHP 4.3.10

[marko <mk...@mc...>]

Hi,

did anyone upgrade to the latest PHP version? I found that the 4.3.10
somehow breaks my application. There had been something like that before
(was it 4.3.6 or so) where they changed some code concerning to cookie
handling and that made the phplib sessioning unusable. Now again it seems
to be broken... But perhaps there are positive experiences from other
users!?!

Would be good to know.

Regards,
Marko

Re: [Phplib-users] Set_File Error

[Sven <Deb...@Ko...>]

Hello

> Here is what I assume to be the appropriate line of code from the
> page:
>
> $t->set_file("page" . $OUT_TEMPLATE);

$t->set_file("page" , $OUT_TEMPLATE);
                   ^^^

-- 
    ciao Sven

[Phplib-users] Set_File Error

[s <sm...@fa...>]

Hello all.

Im getting an error when I am trying to run a template driven test
page im working on stating the following:

Template Error: set_file: For varname pagelisting2out.html filename is
empty.
Halted.  

Here is what I assume to be the appropriate line of code from the
page:


$t->set_file("page" . $OUT_TEMPLATE);

Ideas?
What power would hell have if those imprisoned here would not be able to dream of heaven?

Re: [Phplib-users] Google, Session4 and block_alien_sid

[Nathaniel P. <np...@te...>]

Virilo Tejedor wrote:

>   After several attempts, finally Google bot visits all my site (also
>dynamics pages).
>
>   The problem is that Google have indexed something like:
>mysite.com/article.php?article_id=111&Mi_Session=843e8bd410a726f15f63d0dfcc7
>da532
>
>   Im using phplib 7.4 with 'session4.inc' session class.  I have noticed
>that there is not block_alien_sid flag like in 'session.inc'.  Then all
>visitors linked by Google, are using the same session.
>  
>
Since session4.inc uses PHP's built-in session handling, the problem is 
with that, not with PHPlib. You'll want to take a good look at PHP's 
documentation on it: http://us2.php.net/manual/en/ref.session.php

In your case, as long as your sessions expire within a reasonable amount 
of time (i.e. a few hours at most), it shouldn't be a widespread 
problem. PHP will simply discard the session in the URL if it has 
expired and create a new one.

>   I have thought in blocking alien sessions, clearing this string from
>URL.  But I cant manage a list with forbidden session ids, because there is
>many bots, and they use a new session each time.
>
>   One possible solution could be "ip-blocking".  I have readed that this
>isnt the best solution for session hijacking, due to the proxies, but can
>solve my problem with Google.
>
>   There is a better solution? Or any implementation for ip-bloking?
>  
>
There are a couple of possibilities. (Be aware, I have no experience 
using these settings; you might want to ask one of the general PHP lists 
about this for a firsthand account.) First, if your site doesn't require 
sessions to work properly, or you're willing to limit sessions to only 
clients that support cookies, you can fix this problem by setting the 
session.use_only_cookies setting to true, which disables the Session ID 
in the URL. This is probably one of the better solutions, as most 
clients that have cookies off are likely aware of the issues involved in 
not accepting cookies. However, if googlebot (which doesn't care about 
cookies, AFAIK) needs to have it's own session in order to properly 
index your site, this will cause problems. (However, one might argue 
that you have a flawed design if that is the case.)

Another possibility would be to use session.referer_check, set to your 
website address. However, this would likely keep sessions from working 
on clients that either set an empty string for their referrer or that 
spoof it for privacy reasons. I don't know if googlebot is such a 
client, so again, this may cause problems if googlebot must have a 
session to index your site.

You could disable or destroy sessions when the user agent looks like 
googlebot or some other search bot (via their IP or useragent string, 
perhaps).

Another possibility is to store the user's IP address with the session 
when it is first created (is that what you meant by 'IP blocking'?), 
then make sure that IP address matches each time the session is called 
back up. However, this can cause problems if you can't depend on the 
user of the site to maintain a single IP address for the duration of the 
session (not uncommon with large ISPs that use proxies, such as AOL). 
This can be mitigated to some degree by only matching the first 2 or 3 
octets of the address.

A related topic is also discussed at this thread on the PHP-General 
mailing list:
http://marc.theaimsgroup.com/?t=102722998300003&r=1&w=2

Again, I'd recommend posing the question to one of the PHP mailing lists 
for more specific answers.

Hope this helps.

-- 
___________________________
Nathaniel Price
http://www.tesserportal.net
Webmaster

Re: [Phplib-users] Sessions in text files

[Layne W. <la...@dr...>]

Hristo Odiseev wrote:

> My last experience was that the last time I did a repair I got a 11MB
> table (before repair - 233MB). As you see that is really a problem.
> And if I don't do anything the table grows to 2Gb which is really an
> overkill for mysql. But that was just some background info.

That sounds like a serious problem. If you haven't spent money on
professional MySQL support yet, you probably should try to find some budget
funds to do so.

> Why do you think that the I/O will become a problem? Could you give
> me some reasoning? I guess that the size of the sessions will not be
> so big as it is in the DB. At current its extreme size is mostly due
> to the corrupted data.

The last time (February or March of this year) that I looked into switching
to session4.inc, I started reading the PHP manual comments on PHP 4 native
sessions. Several people mentioned that they sped up their busy sites and
reduced server disk I/O by using a database handler for PHP 4 sessions
instead of the default file handler. After reading that, I abandoned
implementing PHP 4 native sessions and kept using classic PHPLib sessions.

I took a chance and trusted the manual comments so I don't have any persona=
l
experience to back up the assertion.

--=20

Layne Weathers