Why is that any better than

Code: Select all

<form id="indexform" method="post" action="./sensitivepage.php?sid=<? echo session_id(); ?>">

?

I can still view source and see the value of your hidden input if I really want to get at the sid. I guess you could encrypt/decrypt it, but you could do that passing it in the querystring as well.