“It *is* possible to pass the php session information (print(“?”.session_name().’=’.session_id());) to the upload script but that’s not a viable option due to security concerns. ”

Why is that so unsecure ? Do you think cookies are safer in this regard ?

Basically your server takes input from REQUEST composed of GET/POST/COOKIE … no matter where you put the session_id, it still must be sent from a public part so i still wonder, why does it seem unsecure, maybe i am missing something.

I’m faced with the same issue as you – would you mind sharing your hack to resolve this issue?

Many thanks,

Bryn.