在PHP中安全地保存会话数据

Question

I was trying to understand how sessions work in PHP and found that session data is by default stored in the file system. In a shared hosting environment, session data can be read by PHP scripts written by any user. How can this be prevented ?

Answer 1

You can override the session save handler for your script to use something other than the filesystem, such as a database or memcache. Here is a detailed implementation: http://phpsec.org/projects/guide/5.html

Answer 2

Depends on the level of access you have to the php.ini file - if you're on a Shared Hosting environment which runs suPHP and allows you to have your own php.ini file (for instance) then you can simply set the session.save_path to a path like ~/tmp instead of /tmp which is usually shared.

To begin with though, I don't think that you actually CAN read php session data from other applications. I believe it's something rather unique to the person viewing it.

Finally php Session data is not solely file system saved only. It can also be setup to save in a cookie on the user's machine or you can setup php session data to be stored in a database.

Answer 3

Write your own SESSION wrapper.

For example CodeIgniter's session library doe's not depend on PHP's native one and it's more secure:

Note: The Session class does not utilize native PHP sessions. It generates its own session data, offering more flexibility for developers.

Answer 4

您可以使用session_save_path（）将会话数据目录更改为未共享的目录。

Answer 5

Use session_save_path() and change your session folder like "/htdocs/storage/sessions". Now sessions only saved to your given path.