title: How to reset session on each request?
body: <pre><code>            class userSessionManager
  {
      public $_uname;
      private $_pword;
      private $_userDB_Accessor;
  
      function __construct($userAccessor)
      {
          $this-&gt;_userDB_Accessor = $userAccessor;            
      }
      function tryLogin()
      {
          //  get user information
          if ($_SERVER['REQUEST_METHOD'] == 'POST')
          {
              // get username and pasword from POST data and make it safe for database
              $this-&gt;_uname = quote_smart(htmlspecialchars($_POST['userName']));
              $this-&gt;_pword = quote_smart(htmlspecialchars($_POST['password']));
          }
          else // username and password were not set
          {
              return false;
          }
  
          $loginPassed = $this-&gt;_userDB_Accessor-&gt;login($this-&gt;_uname, $this-&gt;_pword);
  
          if($loginPassed == true)
          {
              $this-&gt;makeSession();
          }
  
          return $loginPassed;
      }
      private function makeSession()
      {
          session_start();
          $_SESSION['userName'] = $this-&gt;_uname;
      }
      function userHasSession()
      {
          session_start();
          if(! isset($_SESSION['userName']))  // session not properly created
          {
              return false;
          }
  
          $this-&gt;_uname = $_SESSION['userName'];  //save username to object
  
          //destroy and recreate session for security reasons
          session_destroy();
          $this-&gt;makeSession();
          return true;
      }
  }
  </code></pre>
  
  <p>So, I read <a href="http://en.wikipedia.org/wiki/Session_fixation" rel="nofollow">this</a> article on how someone could gain access to an account with the session ID number. One solution listed was to reset the session ID number each time the page is loaded. Would this be a secure implementation of that idea?</p>
  
  <hr>
  
  <p>Thank you all for the suggestions here is what I did to use them:</p>
  
  <pre><code>        private function makeSession()
      {
          session_start();
          session_regenerate_id();    // reset session id for securty
          $_SESSION['userName'] = $this-&gt;_uname;
          $_SESSION['userIP'] = $_SERVER['REMOTE_ADDR'];
          $_SESSION['userBrowser'] = $_SERVER['HTTP_USER_AGENT'];
      }
      function userHasSession()
      {
          session_start();
  
          if(!isset($_SESSION['userName']) || // check for a created user
              $_SESSION['userIP'] != $_SERVER['REMOTE_ADDR'] || // check for the same IP address
              $_SESSION['userBrowser'] != $_SERVER['HTTP_USER_AGENT'] //check for same Browser and OS
              ) 
          {
              session_regenerate_id();
              session_unset();
              session_destroy();
              return false;
          }
          return true;    // legit user
      }
  </code></pre>