session通常放在/tmp目录下而该文件夹权限是everbody可读这个就非常可怕了！学校论坛曾经就有人通过session来盗取帐号！所以后来就尝试把session放入思路方法为:
<?
"XX.php";//XX.php
session_start;
//以下就可以正常使用session了
?>

/******************************************************/
XX.php 内容:
/*****************************************************/
<?
$sess_dbh="";
$sess_maxletime=get_cfg_var("session.gc_maxletime");

function sess_open($save_path, $session_name) {
global $hostname, $dbusername, $dbpassword, $dbname, $sess_dbh;

//$sess_dbh=mysql_pconnect($hostname,$dbusername,$dbpassword) or die("不能连接数据库！");
$sess_dbh=mysql_pconnect(@#localhost@#,@#test@#,@#test@#) or die("不能连接数据库！");

// mysql_select_db("$dbname") or die("不能选择数据库！");
mysql_select_db(@#test@#) or die("不能选择数据库！");
(true);
}

function sess_close {
//mysql_close;
(true);
}

function sess_read($sid) {
global $sess_dbh;

$result = mysql_query("select data from sesslib where sid=@#$sid@#", $sess_dbh);
$n=mysql_num_rows($result);
($n0) {
("");
}
{
$sess_data=mysql_result($result,0);
($sess_data);
}
}

function sess_write($sid, $sess_data) {
global $sess_dbh;
(!empty($sess_data)){
$r=mysql_query("insert o sesslib sid=@#$sid@#,data=@#$sess_data@#,time=now", $sess_dbh);
(!$r) { // insertion failed, means the session is already there, update it
$r=mysql_query("update sesslib sid=@#$sid@#, data=@#$sess_data@#, time=now where sid=@#$sid@#",$sess_dbh);
}
$r;
}}

function sess_destroy($sid) {
global $sess_dbh;

$r=mysql_query("delete from sesslib where sid=@#$sid@#", $sess_dbh);
($r);
}

function sess_gc($maxletime) {
global $sess_dbh, $sess_maxletime;

$r=mysql_query("delete from sesslib where unix_timestamp(now)-unix_timestamp(time)>$sess_maxletime", $sess_dbh);
mysql_affected_rows($sess_dbh);
}

session__save_handler("sess_open", "sess_close", "sess_read", "sess_write", "sess_destroy", "sess_gc");

?>

这样来安全多了......