Member Avatar for anthonyjpv

if I use session in a web app

can I be assured that every guest who visits the site has a unique session id?

and for example I use a rand() to generate and store a $_SESSION

can I be assured that every set of rand() is also unique?

say min is 123456789 and max is 1234567890

if not

how can I check each of sessions stored to see whether rand() has already generated same number?

is there such thing as looping through sessions?

thanks!

  • 4 Contributors
  • 5 Replies
  • 109 Views
  • 19 Hours Discussion Span
  • Latest Post Latest Post by vaultdweller123

Dani AI

Generated

Short answer for : do not rely on rand() for per-visitor identifiers and let PHP manage session identifiers instead of rolling your own. As noted, collisions can occur; the practical way to avoid them is to use a cryptographically suitable generator or the session subsystem rather than scanning all active sessions.

Concrete suggestions and patterns you can apply now:

  • Create a short, secure per-visitor token (keeps logic simple and avoids depending on PHP internals). Example:

    session_start();

if (empty($_SESSION['visitor_token'])) {
    // preferred: cryptographically secure
    $_SESSION['visitor_token'] = bin2hex(random_bytes(16));
    // or, if available, use session_create_id() to get a session-style id
    // $_SESSION['visitor_token'] = session_create_id('visitor-');
}

    On successful login replace or regenerate the session id:

    session_regenerate_id(true);

    See random_bytes and session_create_id.

  • If you must track visitors across requests (and prevent duplicates), store the token or session_id() in a database table with a UNIQUE constraint. That is more reliable than attempting to loop through PHP's internal session store. Example schema idea:

    CREATE TABLE visitors (
  id INT AUTO_INCREMENT PRIMARY KEY,
  session_token VARCHAR(128) UNIQUE,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

    Insert on first visit and update on login. If you use DB-backed PHP sessions, consider implementing session_set_save_handler() for consistent cleanup and queries (session_set_save_handler).

Security notes: enable session.use_strict_mode, set session.cookie_httponly and session.cookie_secure where appropriate, avoid exposing ids in URLs, and always call session_regenerate_id(true) when elevating privileges to prevent fixation. These measures complement ’s idea of a visitors table and address the fixation risk that plain tokens can introduce.

Recommended Answers

All 5 Replies

Member Avatar for deceptikon

can I be assured that every guest who visits the site has a unique session id?

No, though the likelihood of a collision is rather low.

and for example I use a rand() to generate and store a $_SESSION

can I be assured that every set of rand() is also unique?

Certainly not, and the likelihood of repeated random numbers is very good. If you want a unique customer id then I'd recommend looking into options other than just a pseudorandom number.

Is the customer id only used for that session, or are you storing it in a database for later retrieval?

Member Avatar for anthonyjpv

Is the customer id only used for that session, or are you storing it in a database for later retrieval?

t wont be saved in the database, customer id genrated by rand will then be updated to real customer id once customer has logged in.

No, though the likelihood of a collision is rather low.

what do you suggest then? is there such thing as setting a certain session id?

thanks!

Member Avatar for deceptikon

customer id genrated by rand will then be updated to real customer id once customer has logged in.

I'm not sure I understand the logic. You're generating a temporary id for some reason?

what do you suggest then? is there such thing as setting a certain session id?

I'd need a better idea of what you're trying to accomplish to make a suggestion.

Member Avatar for Member #120589

Why don't you create a visitors table linked to session id. When the session is no longer valid it gets garbaged along with the visitor id. However, if a visitor performs an action that means that the data should be transferred to the main tables, you shouldn't have any collisions - you could set a cron job to do this or set up DB sessions. As mentioned rand() should never be used to get unique numbers. A db table set with an autoincrement field linked to the session *should* obviate collision. My 2p - correct me if I'm wrong.

Edited by Member #120589 because: n/a
Member Avatar for vaultdweller123

session id's are unique

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.