Quote Originally Posted by lat9 View Post
I did a quick search on a ZC 1.5.5e site and the only occurrence of union (other than a comment in the Mobile_Detect script) was in the admin's developers_tool_kit.php....
did you use grep? .... oh wait a minute.... don't you develop using windows?? ;)

ok, here is my latest opinions on this situation...

as i previously stated, stringIgnoreNull may address this issue, but it is a bandaid, and the datatype is not really an accurate description of what it does. another topic... and not integrated into the latest versions of the sessions.php script.

deleting the data in the sessions table does nothing.

the problem is in the browser's cookie; it seems to me the browser cookie zenid somehow got compromised and perhaps will use the sessionID to execute some sort of attack. if you look at my post #42 above, you can see how close my sessionID is to the one reported by gwynwyffar. coincidence? i don't think so...

if you delete record in the sessions table, it will just get re-created by the browser cookie (assuming you have changed to stringIgnoreNull), which is why i'm not sure that is such a great idea. and which is why the problem keeps popping up.

until the cookie gets deleted, the problem will remain. that's my latest thinking on this situation....