Weird PHP behavior if I put exclamation point into variable name

问题

I have weirdest problem with PHP itself, that I've ever seen.

Setup:

PHP 5.33, (tried PHP 5.2.14 as well) under IIS

Problem: PHP deletes all session data as soon as I put exclamation point into a key in session array.

Example:

session1.php

session_start();
$_SESSION["foo"] = 'test';
header('Location: session2.php');

session2.php

session_start();
var_dump($_SESSION);
die();

Works fine, I see variable data printed out.

array(1) { ["foo"]=>  &string(4) "test" }

But if I change line in first file to be

$_SESSION["foo!"] = 'test';

$_SESSION["f!oo"] = 'test';

I mean if I add exclamation point -then the $_SESSION array is empty when I get to second file

array(0) { }

I thought this is a buggy version of PHP when I was on 5.2.14, but upgrade didn't help. I don't even know what the problem might be. Maybe this has something to do with Windows setup, or IIS?

Any ideas?

回答1:

well what is your question about? what is the reason of this error or how to avoid it?
A first one is probably because of some odd PHP internals. For example, you cannot use numeric keys with same consequences.
A latter one is even simpler - do not put exclamation point into a key in session array.

As I recall, PHP sessions mechanism came up from the PHPLib - a first PHP framework ever. Written by some volunteer students. Not a very optimal one. Once added to PHP in the version 4.0, become usable only at 4.1 but still with some odd legacy, like register_globals support. The latter one is most likely the reason of your problem. $_SESSION array key must be valid PHP variable name, in sake of that ancient register_globals behavior where session variables become global PHP variables.

回答2:

It's not Windows, it's not Apache or any other webserver, it is PHP core.

I had a look at it - starting from 5.3 to 5.6 and the problem still exists in there: You are not allowed to have an "!" (exclamation mark) or "|" (pipe) inside the session key.

The Suhosin patch will fix it partially. You are then allowed to have an exclamation mark at any position inside your key, but not at first position, so "foo!" is allowed, but not "!foo". A pipe is still forbidden.

The fix:

Change session.serialize_handler in your php.ini to php_binary or php_serialize
Restart the webserver.

Have fun!

来源：https://stackoverflow.com/questions/3486955/weird-php-behavior-if-i-put-exclamation-point-into-variable-name

标签

php

iis

session

variables