What's Here?

Members: 117,290
Replies: 431,130
Topics: 66,544
Snippets: 2,391
Tutorials: 630
Total Online: 2,507
Members: 63
Guests: 2,444

Code Snippets

PHP Source Code

Welcome to Dream.In.Code
	Getting PHP Help is Easy! Join 117,290 PHP Programmers for FREE! Ask your question and get quick answers from experts. There are 2,507 online right now! We've got more than 500 tutorials and 2,000 snippets. Join and find out why Dream.In.Code is the #1 programming help community on the internet! Registration is fast and FREE... Join Now! Chat LIVE With a PHP Expert Register to Make This Box Go Away!

Keep your Sessions on lockdown and prevent Fixation, and Hijacking with this snippet.

Submitted By: joeyadms

Actions:

Rating:

Views: 621

Language: PHP

Last Modified: May 8, 2008

Instructions: Use at the top of your pages, script will start sessions in constructor.

Usage::::

Initialize SessionSecurity, Which will also issue session_start() , also if user's session is open, make sure it belongs to them, if not, make them login again.

Whenever someone logs in, and is authorized, open their session

Snippet

<?php
/**
* Handles Sessions and Security
* @name SessionControl
* @author Joey Adams
*
*/
class SessionControl
{
// Configuration
private $use_user_agent = true; // Use Users' User-Agent in fingerprint.
private $num_ip_digits = 3; // Number of Users' IP digits to include in fingerprint.
private $regenerate_id = true; // Constantly regenerate ID's to prevent attacks.
private $salt; // Randomly Generated String to include in fingerprint.
private $control_word = '_SALT_'; // Control Word to add to Fingerprint.
// Call Start Functions to create salt, and start the session.
function __construct()
{
@session_start();
}
// Initialize Session and Create Fingerprint
public function Open()
{
$this->_intSalt();
$_SESSION['fprint'] = $this->_Fingerprint();
$this->_RegenerateId();
}
// Check to see if Fingerprint is set
public function Check()
{
$this->_RegenerateId();
return (isset($_SESSION['fprint']) && $_SESSION['fprint'] == $this->_Fingerprint('check'));
}
// Create Randomly Generated Salt
private function _intSalt()
{
for($i=0;$i<10;$i++)
{
$grains[$i] = chr(rand(33,126));
}
$this->salt = implode($grains);
$_SESSION['salt_'] = $this->salt;
}
// Create Unique Fingerprint based on configuration
private function _Fingerprint($mode=null)
{
if ($mode == 'check')
{
$fingerprint = $_SESSION['salt_'];
}
else
{
$fingerprint = $this->salt;
}
$fingerprint .= $this->control_word;
if ($this->use_user_agent)
{
$fingerprint .= $_SERVER['HTTP_USER_AGENT'];
}
if ($this->num_ip_digits)
{
$ip_digits = abs(intval($this->num_ip_digits));
if ($ip_digits > 4)
{
$ip_digits = 3;
}
$digits = explode('.', $_SERVER['REMOTE_ADDR']);
for ($i=0; $i<$ip_digits; $i++)
{
$fingerprint .= $digits[$i] . '.';
}
}
return md5($fingerprint);
}
// Regenerate Session ID If Possible
private function _RegenerateId()
{
if ($this->regenerate_id && function_exists('session_regenerate_id'))
{
session_regenerate_id();
}
}
}

Copy & Paste

<?php

/**
 * Handles Sessions and Security
 * @name SessionControl
 * @author Joey Adams
 *
 */

class SessionControl
{

// Configuration
private $use_user_agent = true; // Use Users' User-Agent in fingerprint.
private $num_ip_digits = 3; // Number of Users' IP digits to include in fingerprint.
private $regenerate_id = true; // Constantly regenerate ID's to prevent attacks.
private $salt; // Randomly Generated String to include in fingerprint.
private $control_word = '_SALT_';  // Control Word to add to Fingerprint.

// Call Start Functions to create salt, and start the session.
function __construct()
    {
        @session_start();
    }

// Initialize Session and Create Fingerprint
public function Open()
    {
        $this->_intSalt();
        $_SESSION['fprint'] = $this->_Fingerprint();
        $this->_RegenerateId();
    }

// Check to see if Fingerprint is set
public function Check()
    {
    	$this->_RegenerateId();
   		return (isset($_SESSION['fprint']) && $_SESSION['fprint'] == $this->_Fingerprint('check'));
    }

// Create Randomly Generated Salt
private function _intSalt()
    {
        for($i=0;$i<10;$i++)
        {
            $grains[$i] = chr(rand(33,126));    
        }
        $this->salt = implode($grains);
        $_SESSION['salt_'] = $this->salt; 
    }

// Create Unique Fingerprint based on configuration    
private function _Fingerprint($mode=null)
    {
        if  ($mode == 'check') 
        { 
            $fingerprint = $_SESSION['salt_']; 
        } 
        else 
        { 
            $fingerprint = $this->salt; 
        }
        $fingerprint .= $this->control_word;
        if ($this->use_user_agent)
        {
            $fingerprint .= $_SERVER['HTTP_USER_AGENT'];
        }
        if ($this->num_ip_digits)
        {
            $ip_digits = abs(intval($this->num_ip_digits));
            if ($ip_digits > 4) 
            {
                $ip_digits = 3; 
            }
            $digits = explode('.', $_SERVER['REMOTE_ADDR']);
            for ($i=0; $i<$ip_digits; $i++)
            {
                $fingerprint .= $digits[$i] . '.';
            }
        }
        return md5($fingerprint);
    }

// Regenerate Session ID If Possible
private function _RegenerateId()
    {
        if ($this->regenerate_id && function_exists('session_regenerate_id'))
        {
            session_regenerate_id();
        }
    }
    
}