I am working in admin and some weird time in URL "?SID=XXXXXXXXXXXX" are coming and then Login page is open on that url. But admin is login. Here XXXXXXXXXXX are some alphanumeric characters.
The SID is a "session ID". Magento uses this ID to track a user's activity within the same Magento installation. Normally, Magento powers one website and one store from one installation (database).
Magento could power multiple websites with multiple stores from one installation, though. The SID allows users to stay logged in while navigating across these websites/stores.
I think if you have the function enabled, the SID is sent while accessing catalog URLs so Magento can update the session with the user's location/state for the current website/store.
If you're not running a multi-website or multi-store environment, it's safe to disable the SID on the frontend, the ___SID=U is used in the cache as a placeholder for the session ID. It is replaced by Mage_Core_Model_Url::sessionUrlVar() which in turn calls Mage_Core_Model_Url::sessionVarCallback(). These methods are called from Mage_Core_Block_Abstract::_afterCacheUrl(), which means that any URL found in block output will contain the correct session ID (if needed).
So to get rid of the parameter in your own code the "right way" use this:
$url = Mage::getUrl('some/magento/route'); // might append ___SID parameter $url = Mage::getModel('core/url')->sessionUrlVar($url); // process ___SID
If the string is displaying in the rendered page that is a bug. Are you using some custom caching module, or generating URL's using a non-standard way?