Session token weak entropy

Code reviewSecuritySenior–Staff~20 min

Review this PHP session-token generator.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1<?php

2function create_session($user_id) {

3 // build a session token

4 $token = md5($user_id . time());

5 $expires = time() + 60 * 60 * 24 * 365; // 1 year

6 $db->query("INSERT INTO sessions (token, user_id, expires) VALUES ('$token', $user_id, $expires)");

7 setcookie('sid', $token, $expires);

8 return $token;

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.