Re: Scripting Languages and Secure Coding + code

[securecodingorg () nuvisions ch]

On Thursday 04 December 2003 11:40, Ghita Serban wrote:
> $_SESSION['username']=$username;
> $_SESSION['password']=$password;

Why would you want to store this (sensitive) data in the session? Someone 
might be able to read the session store, and retrieve the information form 
there.

Setting $_SESSION['ns_isauth'] to true should do imo.

> //we can do other stuff here
> } else {
> header("Location: ./index.php?msg=2");

Afair Location-Header should include the complete new location:
        prot://srv.domain.tld/path/to/file.ext

Set 2nd parameter to 'true' to make sure previous headers are overwritten.