How to make up a unique name for a $_SESSION in PHP?
ip, networking, php, session
Solution
The session is already unique, as it is tied to a cookie for that particular user, on that particular browser. You don't need to worry about it spilling across to other users.
The session id is what ties all this together.
What is actually happening behind the scenes is that PHP stores a cookie on the browser with a unique id (the session id) which is associated with a data structure stored on the server. None of the actual session data ever leaves the server, apart from that id. It's actually a file, you can see it if you poke around in your php folders.
Problem
As part of the login system I'm making, I keep track of failed login attempts inside a unique session named after each client: ``` if($login_failed) { // update failed login attempts $session_name = 'failed_attempts'.$_SERVER['REMOTE_ADDR']; if(!isset($_SESSION[$session_name])) { $_SESSION[$session_name] = 1; } else { $_SESSION[$session_name] += 1; } } ``` As you can see, to determine a unique name for each session I append the user's IP address to the end of the string "failed_login_attempts". If the user reaches 5 failed attempts I require a captcha to be filled out on each subsequent attempt. I'm just worried that there might be some networks where many users are assigned the same IP address, in which case if 1 users fails to login they would all start seeing captchas even though only that 1 user needs to be shown the captcha. Is this reasonable or is there never a situation where 2 users can have the same IP, for example they may have the same first 3 octets but the last number will be different in which case I don't have to worry. If there is a chance of multiple users sharing the same IP then what is a good way to determine a unique identifier for my session name that will link a non-logged in user to the session?