I place a user's db record into a session array (including password).
How safe is this? I mean other than if they walk away without logging
out what is the chance someone could somehow extract the session
array's data?

Mike

On 9/18/2011 10:56 PM, Mike wrote:
MySQL knows nothing about sessions.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex (AT) attglobal (DOT) net
==================

El 19/09/2011 4:56, Mike escribió/wrote:
Well, session values are stored in the context of current connection so
they should be private enough... unless you reuse the connection.

(I was not aware that you could use arrays in session variables.)


--
-- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
-- Mi sitio sobre programación web: http://borrame.com
-- Mi web de humor satinado: http://www.demogracia.com
--

On Sun, 18 Sep 2011 23:10:37 -0400, Jerry Stuckle
<jstucklex (AT) attglobal (DOT) net> wrote:

No I suppose not. Actually I was intending to see what those using
databases (and I assume heavily relying on sessions in many
situations) thinks of the security issues of using sessions.

I did take the precaution of clreaing the password form the session
array.

Mike

Unless you serialize a session into database, you dilettante.

As safe as the access to your session storage.

On 9/23/2011 4:46 PM, Jacek Krysztofik wrote:
MySQL still knows nothing about sessions. It's just data to it.

But I also understand that's just too complicated for a stoopid troll
like you.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex (AT) attglobal (DOT) net
==================

You should limit the data in session to the ID of the record. Every time
a session is read you should reread the record from DB for the simple
reason that in the meantime the account may get disabled, and the
session should be made invalid, which wouldn't happen if you gave up
updating the user data from the database.

Aside from that and superfluousness, there's no reason to avoid storing
user data in the session, granted the session storage is secure.