I'm a little confused about the use of sessions for what I'm planning. A not logged in user visits my site and uploads a file. This user has control over ownership of the file for the duration of their session (set using session_id()). However, to recognize that the user has control, the session id is inserted into the database for verification with that users id. Is this good practice? How unique are session ids?
-
2not sure you even need to store anything in the db, just put the file name in the session. – user557846 Jul 23 '12 at 23:06
Session IDs are guaranteed to be unique in the space of currently used ids. Basically, all of the current sessions have a unique id.
This does mean that you cannot rely on session id's for more than just sessions (seems obvious when you say it like that). I suggest doing something like hashing the current time and using that has a unique id for the file.
I would create a different unique id, store it in the session and in the db. Some frameworks and libraries regenerate session ids for security purposes on each request, so it is not good to assume they will never change during the duration of the user session. The only thing you be sure of with session ids is that it will definetly be unique.