[mab]

If you are regenerating the session id and it gets regenerated immediately on the https/ssl connected page, the new one will be exchanged over the encrypted connection and any previous session id won't be valid.

[wirehopper]

You may want to force session initiation through HTTPS - that would ensure the session is not lost as the user transitions into SSL.

[phpdoctor]

Ye i was going to use the regenerating thing but had problems...
I can get the session back when on the ssl area back that requires sending the session id which i dont want.

Any good way of sending the session id and keeping it secure?

Thanks,
Lex

[mab]

When a page is requested by a browser, the only information you get is what the browser sends. This includes the URL, any parameters on the end of the URL, and any headers sent with the request, such as cookies or post data. The only why to get the session id that corresponds to that visitor is if the browser sends it to you.

[phpdoctor]

Ye i know that
I just want a way send that visitors information to the ssl bit without others stealing it...

Lex

[mab]

Then only use https/ssl for sending the session id back and forth between the browser and the server.