Developer's Guide to Web Application Security

So, which code is better? We hope the answer is obvious.The first method

merely XORs some data together; the second method uses a cryptographic hash

function, in this case the MD5 algorithm, to create a nonreversible string of data. It

does this by using a two-round MD5 of a random number, the time since the

epoch, the process ID, and the address of an anonymous hash (see

http://search.cpan.org/doc/JBAKER/Apache-Session-

1.53/Session/Generate/MD5.pm for details).This method is far more secure and

ensures our session ID cannot be reverse engineered and used to attack our data.

And before you say,“but no one would count on something as simple as an XOR ...