php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #52754 Array keys in $_SESSION with "!" unsets the whole array in PHP 5.3.3
Submitted: 2010-08-31 21:47 UTC Modified: 2010-09-01 12:56 UTC
From: dotpointer at gmail dot com Assigned:
Status: Not a bug Package: Session related
PHP Version: 5.3.3 OS: Slackware Linux 12
Private report: No CVE-ID: None
View Add Comment Developer Edit
 [2010-08-31 21:47 UTC] dotpointer at gmail dot com 
Description:
------------
Array keys in $_SESSION containing exclamation marks (!) does not seem to work anymore as of 5.3.3.

Have tried key with different characters like #, " and £ - these worked. Using "!" in the key seems not only to be unregistered but also to make the whole $_SESSION to be unset in the next run.

This worked before, as in 5.2.x.

Test script:
---------------
<?
	# (as we're talking sessions, this example need to be run 2 times to set the session data, push F5...)
	session_start();
	$name = 'hello';	# this does work, uncomment/comment to test
	$name = 'hello!';	# this does not, uncomment/comment to test
	echo $_SESSION[$name];
	$_SESSION[$name] = 'OK';		
?>

Expected result:
----------------
That array keys containing exclamation marks ("!") either give a understandable error or does work as any other key.

Actual result:
--------------
The whole array is being totally empty if a key containing exclamation mark is entered.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-09-01 06:25 UTC] aharvey@php.net
-Status: Open +Status: Bogus
 [2010-09-01 06:25 UTC] aharvey@php.net 
I'm not too sure how or why this would have worked in 5.2, but session variables not being able to use certain characters in their names is documented behaviour, per http://php.net/session.examples.basic ​​:

"The keys in the $_SESSION associative array are subject to the same limitations as regular variable names in PHP, i.e. they cannot start with a number and must start with a letter or underscore. For more details see the section on variables in this manual."
 [2010-09-01 12:56 UTC] dotpointer at gmail dot com 
That's fine for me. I did not know that, so I used the site name as key, which worked fine until I updated PHP, then suddenly this happened.
 [2011-02-13 03:12 UTC] paulbc1 at hotmail dot com 
I see that the status for this bug is "bogus". How was that determined? I don't think this bug is bogus at all.

I have just spent more than one week trying to debug a similar problem with php 5 on a Linux server. The exclamation mark was in a MySQL database, but not in the key itself. Yet it still caused the entire $_SESSION array to be unset on the second run of the query.

Oddly, this does not always happen. For example, I ran a select query 10 times consecutively, and it failed on every attempt, except for the 4th, 7th, and 9th. That seems fairly random to me.

The same code has worked fine on php 4 on a windows server for years. So I would like to try it on a PHP 5 windows server, to see if the problem is Linux specific.

Has anyone else experienced the same issue?
 [2011-02-18 23:44 UTC] paulbc1 at hotmail dot com 
Today, tried the same code on a Windows server with PHP 5.2.13 and MySQL 5.0.45 installed, and I have not encountered the problem at all. I have concluded that this bug is either limited to more recent versions of php or MySQL, or it is limited to Linux.

In any case, I don't think this bug should be considered "bogus".
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Fri May 03 23:01:30 2024 UTC