Bug #66827 [Com]: session_start generates PHP Notice if session cookie contains array

Edit report at https://bugs.php.net/bug.php?id=66827&edit=1 ID: 66827 Comment by: narf at devilix dot net Reported by: spam at krol dot me Summary: session_start generates PHP Notice if session cookie contains array Status: Open Type: Bug Package: Session related Operating System: osx PHP Version: 5.5.9 Block user comment: N Private report: N New Comment: Hmm, I guess you do have a point in that, although I'm not sure how $_COOKIE itself is populated. Previous Comments: ------------------------------------------------------------------------ [2014-03-06 12:28:21] spam at krol dot me If malformed cookie can cause application error i would consider this as a bug. Maybe at least is_string check before unserialize? If not I think this can be closed. ------------------------------------------------------------------------ [2014-03-06 12:17:44] narf at devilix dot net That's completely natural, since the cookie value is unserialized by session_start() and you can't unserialize an array(). I wouldn't consider it a bug. ------------------------------------------------------------------------ [2014-03-05 15:07:35] spam at krol dot me Description: ------------ If session cookie contains array instead of session_id string, on session_start() call PHP Notice is generated. Test script: --------------- <?php $sessionName = "PHPSESSID"; session_name($sessionName); $_COOKIE[$sessionName]['key'] = 'value'; session_start(); Expected result: ---------------- false Actual result: -------------- PHP Notice: Array to string conversion in /private/tmp/session-fail.php on line 8 PHP Stack trace: PHP 1. {main}() /private/tmp/session-fail.php:0 PHP 2. session_start() /private/tmp/session-fail.php:8 true ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66827&edit=1