disinfect and validation of sessions and cookies

From a security point of view I'm disinfection and input validation.

Create a session using the displayed username that is disinfected and validated first on a registration of the user.

On further visits when the usernames in their username is validated data base and again a session is created and used throughout their pages.

I put only ever the SESSION for the user, but in my code at the end of the session (according to the information I have seen and read), I finished the session with:

unset($_SESSION['username']);

$_SESSION = array();

invalidate the session cookie

If (isset($_COOKIE['username'])) {}

setcookie ('username', ", time () - 86400, ' / ');

}

session_destroy();

Now, I never really the cookie or use it to my knowledge but I have seen that this code should be used to end a session, so I presume that there is a valid reason and that the SESSION must use the COOKIE and I wonder if $_COOKIE ['username'] must be disinfected whenever the user navigates to a different page in their administration pages I saw that filter_input functions have an option to filter the entrance of cookie. I apologize for not understanding what are cookies in this situation, everything I do is actually set during the connection session and finish on logout.

I do something like:

If (filter_has_var (INPUT_COOKIE, "username")) {}

$cleancookie = filter_input (INPUT_COOKIE, 'username', FILTER_SANITIZE_STRING);

$_COOKIE ['username'] = trim ($cleancookie);

Maybe it would also be useful if I knew why I had reset the session cookies every time I have finished a session, if someone could kindly explain.

Following disinfection session cookies what the stored value in $_SESSION ['username'], so that the user moves between their admin pages this value should be reorganized and if so please could someone advise me how best to do this. Maybe I should validate against the expected values of just say letters and numbers?

Thank you in advance for any help, information and answers to help me to understand and solve the problems of security above.

tessimon wrote:

invalidate the session cookie

If (isset($_COOKIE['username'])) {}

setcookie ('username', ", time () - 86400, ' / ');

}

.. .in my code is not relevant in this situation and can be removed?

At the start of:

unset($_SESSION['username']);

session_destroy();

Yes. That should be enough.

What about the security of the SESSION ID variable is stored as a cookie on the user's computer, can it be corrupted?

Once someone has been connected, it is generally considered a good idea to regenerate the session ID using session_regenerate_id(). To do that only once in respect of the identification of the user information has been verified.

Tags: Dreamweaver

Similar Questions

Maybe you are looking for

  • confused on the sharing of the family

    I was watching the apple music and sharing family came. I know that my family has all different apple ID and I was wondering because some of us do have a credit card for this that we can simply use our gift cards without having to ask the main person

  • HP Envy Touch smart 15-j050us: Upgradation of graphics card

    I want HP touch smart 15-j050 model with intel HD 4600 graphics card. I want to update its graphics. What r compatible with this laptop and also profitable for the same cards.

  • full system restore

    I have the system recovery disc four HP and an extra drive (not sure the supplemental what). I need to do a full system restore. When I insert CD 1 of 4Need me just a screen with four folders; Preload Boot, EFI, hp, and files:bootmgi, bootmgi.efi, Pr

  • mini 210-1142cl RAM update

    question, is possible to upgrade RAM with a MHz higher than the computer can handle, 1333 MHz > 667 MHz? If so, how? I want to upgrade my RAM to the mini 210-1142cl from 1 GB to 2 GB, According to the manual, the mini can accept an upgrade to 2 GB, b

  • How can I do this?

    I bought adobe online and in-store products, always, these products do not meet me somehow... Unfortunately now they go with this cloud thing and that satisfies me... or even provide access to the essential with regard to large files, they offer they