Some security concerns with session libary

[eluser]terrorVogel[/eluser]
Hi all,

when you set sess_use_database to true, it seems that all data is still stored in the cookie. Actually the ip and browser check are against the values received from the client, and these values cannot be trusted.

I have modified the session libary that it suits my needs and i would like to share it with you. Feel free to use without warranty.

Changes: All session data will be stored in the database, the cookie will only contain the sessionId
Changes: A session is started only when data is needed to be stored.

have a nice day.