Session id detection

[sarahk]

I'm looking through some page data and want to eliminate sessions from the variables passed in a url.

I have no way of knowing what the session name will be - it could be sessid, cs, sid, etc. I'm using a standard test of 32 or 82 chars but one of the sites sending me data has variable length session ids.

Is there a standard way to detect this?

examples:
cs=
cs=127bd94c883ffd499bca95c324
c%2F%2F%2F
cs=5433cd98e6d

The easy workaround is trim off the query string but they are often valuable data.

[er2er]

In PHP, this should work:
preg_replace("/cs=[^&]*&?/i",'', $url);
where $url contains the url.

[digitalpoint]

Why are the session IDs named differently? Can't you change them to be consistent?

- Shawn

[sarahk]

Why are the session IDs named differently? Can't you change them to be consistent?If only!

I'm taking data from other sites and I don't want to have to vet them as they come, although I guess I could get them to say how they id sessions - but in the example given they may not even be aware that the session info gets produced for some bots.

I flag the urls which have session info attached and hopefully site owners will use that info to make alternative arrangements for when bots visit. But like the bots I don't want to create a record for every page and session id combination.

I think, Shawn, you've just given me my workaround. I'll store the session id string against the domain - as that will be consistent within the domain.

preg_replace("/cs=[^&]*&?/i",'', $url);
Thanks er2er but I think this relies on the consistent session name.

[er2er]

Yes, it does - I assumed this was what you wanted.
What about:
preg_replace("/(cs|sessionid|sid|sesid)=[^&]*&?/i",'', $url);
It can be easily extended by adding more names to "(cs|sessionid|sid|sesid)"

However, storing what id_name belongs to what domain looks as a beter idea to me :)