Man or may not be usefull:
$time = time * (int(rand 200) + 1);
$session = substr($time, 4, 4) . substr($time, 5, 4);
$session =~ s/(\d\d)/substr("ABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAVA
+WAXAYAZCACBCDCECFCGCHCICJCKCLCMCNCOCPCQCRCSCTCVCWCXCYCZDADBDCDEDFDGDH
+DIDJDKDLDMDNDODPDQDRDSDTDVDWDXDYDZYAYBYCYDYEYFYGYHYIYJYKYLYMYNYOYPYQY
+RYSYTYVYWYXYZQAQBQCQDQEQFQGQHQIQJQKQLQMQNQOQPQRQSQTQVQWQXQYQZ",$1, 2)
+/eg;
substr($session, int(rand 5) + 1, 1) = int(rand 9);
Essentually, take the current time (in EPOC) convert that to random letters, and save it in $session. You can then push that as a cookie or form element, as well as save it to the database table. This would handle a session, and should never ever be the same for any two users. As far as putting URI's or other info into the $session handler, I'd go with either adding more cookie entries or form field enteries. Keep in mind, users are nasty. They will do anything to keep there information private. So, adding a check for the cookie before processing is the best way to go, if the check fails and your database shows an entry saying that the user is logged in, then check the form fields, if they block both then there probibily blocking javascript, thus chances are, there not going to effectivily be able to use any web site that requires session id's or form information.
The coding is far from perfect and far from a solution. Just adds an alternative. You could, alternativily, catch the calling IP from the users broswer informaition (that usually is available even when everything else isn't), and use that with your database to handle the sessions. Meaning, if the user comes from the IP 127.0.0.1, and cookies are not present, javascript doesn't work, and form fields arn't comming through, save the IP to the database, and refer to the IP from the browser and database to confirm sessions. No two IP's should ever be the same. Id also send a message to the user, in the html document, telling them that cookies should be allowed for the site in order to effectivily use it. If they don't what to allow cookies, then why are they even visiting the site and using the functions....
