Use this function in place of session_start().
To protect against session attacks
//Celox Systems LLC 2008 function chk_session(){ $name = session_name(); session_start('$name'); if (!isset($_SESSION['login_ok'])){ //New session. $_SESSION['login_ok'] = 1; $_SESSION['old_user_agent'] = $_SERVER['HTTP_USER_AGENT']; $_SESSION['old_remote_addr'] = $_SERVER['REMOTE_ADDR']; return 1; } else{ if ($_SESSION['old_user_agent'] != $_SERVER['HTTP_USER_AGENT'] || $_SESSION['old_remote_addr'] != $_SERVER['REMOTE_ADDR']){ $_SESSION = array(); session_destroy(); //Fixation attack, more than one computer with same session id. return 2; } else{ session_regenerate_id(); //Get new session id for fixation attack protection return 3; } } }