php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Doc Bug #37629 register_globals makes $_SESSION misbehave
Submitted: 2006-05-29 15:49 UTC Modified: 2006-10-23 09:18 UTC
Votes:2
Avg. Score:2.5 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:1 (50.0%)
From: phpbugs at asystance dot nl Assigned:
Status: Not a bug Package: Documentation problem
PHP Version: 4.4.2 OS: Windows XP / Debian Linux
Private report: No CVE-ID: None
View Developer Edit
 [2006-05-29 15:49 UTC] phpbugs at asystance dot nl 
Description:
------------
When register_globals = On (I know this is legacy), $_SESSION behaves differently than the other superglobals and this (mis)behaviour is not documented.

This is actually a duplicate of (or maybe just related to) bug #25110. sniper@php.net calls this behaviour a "feature". I strongly disagree.

What we should agree on is that it's undocumented and unexpected. Neither the documentation on register_globals nor the documentation on superglobals mentions this. It also only works with $_SESSION (and not with other superglobals), so the behaviour is very unexpected.

I tested this with two debian installations (4.4.2-1+b1 on Apache 2.0.55 and 4.3.10-16.8 on Apache 1.3.33) and the latest Windows zip package 4.4.2 on Apache2.

Reproduce code:
---------------
<?php
session_start();
$_SESSION['var'] = 'hello';
$var = 'again';
echo $_SESSION['var'];
?>


Expected result:
----------------
Output is 'hello'

Actual result:
--------------
Output is 'again'

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-05-29 15:52 UTC] phpbugs at asystance dot nl 
changed version
 [2006-05-30 17:08 UTC] judas dot iscariote at gmail dot com 
this is a "misfeature", and I don't think It would be fixed at all in 4.4 doing so, will break a lot code...

it is fixed in php6, since register_globals is gone.

Just Do not use register_globals.
 [2006-10-23 09:18 UTC] sesser@php.net 
Sorry, but your problem does not imply a bug in PHP itself.  For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system is not the
appropriate forum for asking support questions.  Due to the volume
of reports we can not explain in detail here why your report is not
a bug.  The support channels will be able to provide an explanation
for you.

Thank you for your interest in PHP.

It is only documented that on session_start() the content of _SESSION will be globalized. Or when you use session_register().

It is nowhere mentioned that inserting something into _SESSION magically creates a global variable or a reference to it.
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved. 		Last updated: Tue Feb 10 03:00:01 2026 UTC