PHP session_regenerate_id和Blackberry浏览器

Question

Greetings,

I am working on a login system and getting stuck with Blackberry browsers authenticating. It seems they have an issue with PHP's session_regenerate_id(), can someone suggest an alternative? Here are the auth and login scripts:

UPDATE It would appear that sessions in general are not working. Took out session_regenerate_id() just to see if it would work and it just redirects me every time, as though the $_SESSION['MD_SESS_ID'] were blank. Really stuck here, any ideas would be appreciated. Cookies on the device are enabled, using a Blackberry Bold 9650. It works on my iPod Touch and every browser on my PC.

Login

<?php
session_start();
include $_SERVER['DOCUMENT_ROOT'] . '/includes/pdo_conn.inc.php';
//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
 $str = @trim($str);
 if(get_magic_quotes_gpc()) {
  $str = stripslashes($str);
 }
 return $str;
}
$username = clean($_POST['username']);
$password = clean($_POST['password']);

if ($username != "" && $password != "") {
 $getUser = $db->prepare("SELECT id, username, password, salt FROM uc_dev WHERE username = ? LIMIT 1");
 $getUser->execute(array($username));
 $userDetails = $getUser->fetch();
 $dbPW = $userDetails['password'];
 $dbSalt = $userDetails['salt'];
 $hashedPassword = hash('sha512', $dbSalt . $password);
 if ($hashedPassword == $dbPW) {
  //Login Successful
  session_regenerate_id();
  $_SESSION['MD_SESS_ID'] = $userDetails['id'];
  header('Location: http://somewhere.com');
  session_write_close();
 } else {
  header('Location: http://www.somewhere.com');
  exit();
 }
} else {
 header('Location: http://somewhere.com');
 exit();
}
?>

Auth

<?php
//Start the session
session_start();
//Verify that  MEMBER ID session is present
if(!isset($_SESSION['MD_SESS_ID']) || (trim($_SESSION['MD_SESS_ID']) == '')) {
  $_SESSION = array();
  // Note: This will destroy the session, and not just the session data!
  if (ini_get("session.use_cookies")) {
   $params = session_get_cookie_params();
   setcookie(session_name(), '', time() - 42000,
   $params["path"], $params["domain"],
   $params["secure"], $params["httponly"]
   );
  }
  // Finally, destroy the session.
  session_destroy();
  header("Location: http://somewhere.com");
  exit();
 }
?>

Answer 1

A while ago, I was doing some Blackberry development, and found out that the browser couldn't handle multiple cookies with the same name. Not sure if they've fixed this yet.

So if you're sending out the Set-Cookie header more than once (using setcookie , session_start , or session_regenerate_id ), using the same name each time, this could be causing your problem.

You might want to keep track of the cookies you need to output, in an object or array, and only send them to the browser at the very end of the request. This way, if you need to change their values in the middle of the request, you can just overwrite the array's value, rather than sending out another cookie header.

This page may also help -- someone linked to it from PHP's session_regenerate_id page.