sanitize and validation of sessions and cookies

from security point of view sanitizing , validating input.

on user registration create session using posted username sanitized , validated first.

on further visit when user logins in username validated database , again session created , used throughout pages.

i ever set session user in code end session (as per information have seen , read) end session :

 

unset($_session['username']);

$_session = array();

// invalidate session cookie

if (isset($_cookie['username'])) {

setcookie('username', '', time()-86400, '/');

}

session_destroy();

 

now, never set cookie or use knowledge have seen code should used end session, therefore presume there valid reason , session must use cookie , wondering if $_cookie['username'] should sanitized each time user goes different page in administraion pages,  have seen filter_input functions have option filter cookie input. apologise not understanding cookies in situation used for, set session on login , and end on logout.

would need doing like:

 

if(filter_has_var(input_cookie, "username")) {

$cleancookie = filter_input(input_cookie, 'username', filter_sanitize_string);

$_cookie['username'] = trim($cleancookie);

 

perhaps if knew why having reset session cookies when end session, if kindly explain.

 

further sanitizing session cookies value stored in $_session['username'], user moves between admin pages should value sanitized , if please advise me of best method this. have perhaps validate against expected values of letters , numbers?

 

thank in advance help, information , answers me understand , resolve above security issues.

tessimon wrote:

 

perhaps if knew why having reset session cookies when end session, if kindly explain.

php sessions rely on cookies being enabled, don't use cookies store values such username. instead create session variables.

 

the difference values in cookie stored on user's computer. values in session variables stored on server. value that's stored on user's computer session id (which stored cookie).

 

when closing session, using unset() session variables followed session_destroy() should sufficient. if have large number of session variables, following line of code has effect of destroying them all:

 

$_session = array();

 

running session_destroy() removes session id user's computer.

More discussions in Develop server-side applications in Dreamweaver

adobe