Bug #18071 Updated: unset($_SESSION['name']); not works when varible is readed before unset

ID: 18071 Updated by: manzella@lucent.com Reported By: lampa@brutusmud.net Status: Critical Bug Type: Session related Operating System: win 2k, debian 2.2 PHP Version: 4.2.1 New Comment: this issue is especially nasty when there's an "initiator" script that does validation of user before it is taken to the "main" script. if the latter relies on recursion and checking for instance that a $_SESSION['comingfromscript'] is not set (against cut&paste of the URI) before proceeding, the test will unexpectedly succeed if in a previous recursion step the $_SESSION['comingfromscript'] has been assigned to a normal variable even if afterward the $_SESSION['cominfromscript'] is unset. Previous Comments: ------------------------------------------------------------------------ [2002-06-30 08:46:22] sander@php.net Reproduced with 4.3.0-dev. Something really weird is going on (some reference-stuff?). Making this critical. ------------------------------------------------------------------------ [2002-06-30 07:35:21] lampa@brutusmud.net when using unset($_SESSION[...]) insted session_unregister(...) and before calling read _$SESSION[...] variable WILL NOT unset. please try these examples and see result. here is method how to produce this bug (you must have cookies enabled): 1. run script 2. reload page (you should see 2 $_SESSION arrays with the same value) 3. click on unset link 4. now you should see first array filled with test value and second should be empty - that's OK - but variable test should be deleted from session 5. reload page 6. here is BUG: i unset session variable test so i shouldn't exists, but exists. --- 7. comment line marked #fatal and go to repeat process from begining on step 6. both arrays will be empty!!!! <?php session_start(); echo '<pre>'; print_r($_SESSION); if (isset($_GET['submit'])) { $test = $_SESSION['test']; # fatal unset($_SESSION['test']); } else { $_SESSION['test'] = 'this is test'; } echo '<a href="'.$_SERVER['PHP_SELF'].'?submit=yes">unset</a><br>'; print_r($_SESSION); echo '</pre>'; ?> replace unset($_SESSION['test']); with session_unregister('test'); and repeat process - here will be everything OK. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=18071&edit=1