我真的非常怀疑这是一种病毒.仔细检查该字符串是否真的是会话ID (这确实是引起关注的原因).我的猜测是，这是一个小孩，他发现了如何在浏览器中更改 User Agent 字符串，并且您看到的结果是完全无害的.

关于增量问题.

• 首先，检查 mySQL服务器的auto_increment_increment 设置.也许出于某种原因将其设置为2?

• 第二，如果不是那样，我将查看注释系统在表上运行的所有DELETE操作.被识别为垃圾邮件的评论会被删除吗?您可以记录删除一段时间，还是切换到软删除?

• 此外，尝试自己创建一些后续注释.是否会出现相同的现象?如果您使用mySQL手动添加记录怎么办?

• 在PHP代码中仔细查看插入的提交的注释，以确保没有任何东西可以导致此行为.

• 尝试将评论系统移至其他服务器(***是本地服务器，也许是新设置的服务器)，以查看行为是否在那里仍然存在.

There's an InnoDB table for storing comments for blog posts used by a custom built web application.

Recently I noticed that the auto incremented primary key values for the comments are incrementing by 2 instead of just 1.

I also noticed that in another MySQL table which is used for remembering the last few commenter's footprint signature (e.g. ip, session id, uagent string, etc) the name of the PHP session starts with "viruskinq" which is weird because I thought it should always be a hexadecimal md5-like string.

Google yields only a couple of results for "viruskinq", all in Turkish. It is interesting because approximately a year ago the website in question was defaced by Turkish villains. (I'm 100% sure that the attackers didn't succeed because of any security holes in my app, because other websites, hosted by the same company, were defaced too at that time.)

The site is on a shared host, using Linux.

Do you think it is possible that the server itself may still be under the influence of those hackers? Examining the comment's id values revealed that this doubling phenomena exists since this May, but the defacing happened almost a year ago.

What other causes could there be that explain the weird behavior of the auto increment value? The application hasn't been changed and at older comments the auto incremented primary key values are in order.

Edit: Summary of the solution

The hosting company informed me that the reason of the doubled auto increment value is because they use a Master-Slave MySQL architect and according to them this phenomena is normal.

They also admitted that various hackers are constantly attacking their servers, "especially the sessions" and they cannot do anything about it.

I think I better start packing my things and move to a better webhost.

I really, really doubt this is a virus. Double-check whether that really is the session ID that starts with that string (which would indeed be reason for some concern). My guess would be this is a kid who discovered how to alter the User Agent string in the browser, and you are seeing the results of that, which is entirely harmless.

In regards to the increment problem.

• First, check the auto_increment_increment setting of your mySQL server. Maybe it was set to 2 for some reason?

• Second, if it's not that, I would look at all DELETE operations that the comment system runs on the table. Do comments recognized as spam get deleted? Can you log deletions for a while, or switch to soft deletions?

• Also, try to create some subsequent comments yourself. Does the same phenonmenon occur? What if you add records using mySQL manually?

• Look through the PHP code inserting a submitted comment making really sure there is nothing that could lead to this behaviour.

• Try moving the comment system to a different server - preferably a local one, maybe freshly set up - to see whether the behaviour persists there.