session注入，最好的防御方式是将session存储到数据库

1.index.php

<?php
session_start();
?>
<form action="inject.php" method="POST">
<?php
$path = ini_get('session.save_path');
$handle = dir($path);
while ($filename = $handle->read())
{
if (substr($filename, 0, 5) == 'sess_')
{
$sess_data = file_get_contents("$path/$filename");
if (!empty($sess_data))
{
session_decode($sess_data);
$sess_data = $_SESSION;
$_SESSION = array();
$sess_name = substr($filename, 5);
$sess_name = htmlentities($sess_name, ENT_QUOTES, 'UTF-8');
echo "<h1>Session [$sess_name]</h1>";
foreach ($sess_data as $name => $value)
{
$name = htmlentities($name, ENT_QUOTES, 'UTF-8');

$value = htmlentities($value, ENT_QUOTES, 'UTF-8');
echo "<p>
$name:
<input type=\"text\"
name=\"{$sess_name}[{$name}]\"
value=\"$value\" />
</p>";
}

echo '<br />';
}
}
}
$handle->close();
?>
<input type="submit" />
</form>

2.inject.php

 

<?php
session_start();
$path = ini_get('session.save_path');
foreach ($_POST as $sess_name => $sess_data)
{
$_SESSION = $sess_data;
$sess_data = session_encode();
echo $sess_name."=>" .$sess_data."<br/>";
file_put_contents("$path/sess_$sess_name", $sess_data);
}
$_SESSION = array();
?>