Is it possible to modify the $_SESSION variable?

问题:

Is it possible for an malicious user to set the $_SESSION (in php) variable to any value he wants?

回答1:

Yes, by using another user's session data, as shown here: http://phpsec.org/projects/guide/4.html

回答2:

Highly depends on your code. Something very obvious: $_SESSION['username'] = $_REQUEST['username'].

回答3:

It depends on how you set the sessions variable. An user can exploit the way you set them.

The most common attacks with sessions is session fixation : http://en.wikipedia.org/wiki/Session_fixation

回答4:

If you provide a means for him to do so (bad/insecure code), it is possible. However, this is generally unlikely.

回答5:

Not typically, but they could if, for instance, you had a remote code execution vulnerability in your PHP.

回答6:

Unless you have done something wrong in your code he cant set it on your server, what he can do is steal some other users session cookie and get in that way... in other words; he can change his own session cookie that your $_SESSION use to identify him

回答7:

No, not if your code is correct and doesn't allow to set values based on unverified userinput.

回答8:

Yes. If you use something from a cookie or another similar request method that a user can edit to interact with the session then there is a change. For example say you make an online store and store the item id's in the cookie and on page refresh pushes it into the session. While on the page a user can edit the cookies so when it goes into the session it have been modified.

回答9:

Yes, when REGISTER_GLOBALS in on.