php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #51127 $_SESSION illogical behaviour
Submitted: 2010-02-23 18:56 UTC Modified: 2013-08-21 02:15 UTC
Votes:5
Avg. Score:4.0 ± 1.5
Reproduced:5 of 5 (100.0%)
Same Version:2 (40.0%)
Same OS:2 (40.0%)
From: asanoki at gmail dot com Assigned: yohgaki
Status: Closed Package: Session related
PHP Version: 5.2.12 OS: Linux
Private report: No CVE-ID:
 [2010-02-23 18:56 UTC] asanoki at gmail dot com
Description:
------------
No warning about using not allowed characters as a key in array $_SESSION. It is illogical, and should raise a warning or notice.

In manual it is written that $_SESSION is a superglobal *associative array* (http://pl.php.net/manual/pl/reserved.variables.session.php). Additional restrictions to key names are illogical and unintuitive. Why do a session serialization function uses diffrent algorithm than default serialize() php function which works fine in such situations? 

Example. Using | character as a key in $_SESSION array causes damaging a session file (it gets 0 bytes length) without any notice, warning or error. 

I understand that it is mentioned in manual, but it is illogical, unintuitive and should raise at least a warning.


Reproduce code:
---------------
/* Here is php code which reproduces this error. Fire it *twice*, and look at output of a *second* execution. */

session_start();

echo "This was loaded from session:<br />\n";
var_dump($_SESSION);

$_SESSION["a|b"] = "asdasd";

echo "<br />\nThis is written to session:<br />\n";
var_dump($_SESSION);

Expected result:
----------------
This was loaded from session:
array(1) { ["a|b"]=> string(6) "asdasd" } 

This is written to session:
array(1) { ["a|b"]=> string(6) "asdasd" } 

Actual result:
--------------
This was loaded from session:
array(0) { } 

This is written to session:
array(1) { ["a|b"]=> string(6) "asdasd" } 

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-03-02 14:48 UTC] jani@php.net
-Summary: $_SESSION illogical behaviour. +Summary: $_SESSION illogical behaviour -Package: Feature/Change Request +Package: Session related
 [2010-05-12 16:26 UTC] mike@php.net
-Status: Open +Status: Verified
 [2011-02-03 13:09 UTC] cyberdisyan at gmail dot com
I experienced the same bug, and it took's me one week to understand why my all of my session variables was destroyed into our application. 

BUT the strangest think is that the session_id is still good. 

Anyway as asanoki said a Warning notice should be usefull

Thanks
 [2012-03-26 12:54 UTC] simon at hurix dot de
! (exclamation mark) in the key string is also breaking the whole _SESSION array 
on next hit. I suppose there are some more.
 [2012-03-31 06:39 UTC] yohgaki@php.net
-Assigned To: +Assigned To: yohgaki
 [2012-03-31 06:39 UTC] yohgaki@php.net
Standard serialize will be used as a default serializer handler for next PHP 
release. (e.g. 5.5 or later)
 [2013-08-10 08:03 UTC] yohgaki@php.net
Use php_serialize serialize handler, then you'll not have such issue.

php_serialize is available 5.6 or later.
 [2013-08-21 02:15 UTC] yohgaki@php.net
-Status: Verified +Status: Closed
 [2013-08-21 02:15 UTC] yohgaki@php.net
php_serialize will be available from PHP 5.5.4.

http://git.php.net/?p=php-
src.git;a=commit;h=c51f77fe83cea3a48d89423863e6916b77628e47
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 16 22:02:05 2014 UTC