|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #59069 Session handler unexpected behavior on empty ID strings
Submitted: 2010-02-10 07:49 UTC Modified: 2021-03-25 16:28 UTC
Avg. Score:3.8 ± 0.9
Reproduced:19 of 20 (95.0%)
Same Version:5 (26.3%)
Same OS:5 (26.3%)
From: bugs at prieser dot net Assigned: cmb (profile)
Status: Closed Package: memcache (PECL)
PHP Version: 5_3.1RC2 OS: Debian/Ubuntu
Private report: No CVE-ID: None
 [2010-02-10 07:49 UTC] bugs at prieser dot net
Found this behavior on a productive System:
User calls URI with empty SID parameter like this: 
php / memcache spits out warnings and session functionality is not available on this page (write doesn't work).

Standard PHP files session handler handles this error by generating a new id and uses the new one to write session data and sends a cookie with the new id.

memcache session handler used to throw a ugly warning. Since 3.0.4 it just ignores the problem. Leaves developers alone with probably messed up pages.

Instead of ignoring the issue memcache should generate a new id and use it just like the standard files handler would do.

 PHP: from 5.2.6 to 5.3.1 stable
 memcache: all from 2.2.5 to 3.0.4

 tested on lighttpd with php-cgi

php.ini changes:
 session.save_handler = memcache
 session.save_path = "tcp://localhost:11211"
 session.use_only_cookies = 0

Reproduce code:

  echo session_name()."=".session_id()."<br>\n";



  if ($_GET[session_name()] == "") unset($_GET[session_name()]);

  echo session_name()."=".session_id()."<br>\n";


Expected result:
A new generated Session_id on every reguest for 'test.php?mySID='
if client disabled cookies.

Actual result:
Empty Session_id and no write of session data.
On older memcache versions (<3.0.3) PHP Warnings and Errors like: 

Warning: Unknown: Failed to write session data (memcache). Please verify that the current setting of session.save_path is correct (tcp://localhost:11211) in Unknown on line 0

Warning: session_start() [function.session-start]: Key cannot be empty in /var/www/index.php on line 4


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2021-03-25 16:28 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2021-03-25 16:28 UTC]
The official bug tracker for PECL/memcache is now at

So, if this is still an issue with either of the current memcache
versions (4 or 8), please file an issue there.
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sun Apr 11 17:01:27 2021 UTC