[php-src] Issue #9932: Session name with . or [ silently fails instead of giving warning/error

Issue: https://github.com/php/php-src/issues/9932 Author: Sjord ### Description The following code: ```php <?php session_start(['name' => 'a.b']); ``` Resulted in no output, and $_SESSION variables are not stored. But I expected this output instead: ``` Warning: session_start(): session.name cannot contain any of the following '.[=,; \t\r\n\013\014' in /var/www/html/test.php on line 2 ``` Session simply [reads $_COOKIE](https://github.com/php/php-src/blob/f6c9a90e19d648355c39da84af9bc59b2ff60c15/ext/session/session.c#L1537), and space , period . and opening square bracket [ are [replaced](https://www.php.net/manual/en/language.variables.external.php#example-102) by [underscores](https://github.com/php/php-src/blob/f6c9a90e19d648355c39da84af9bc59b2ff60c15/main/php_variables.c#L232). So setting a session name of a.b writes and reads a cookie called a.b, but $_COOKIE actually contains a_b. This makes session storage silently fail. In a perfect world, session names could contain these characters, but I think a quick and easy fix is to add . and [ to the list of disallowed characters in session names, [here](https://github.com/php/php-src/blob/f6c9a90e19d648355c39da84af9bc59b2ff60c15/ext/session/session.c#L1305): /* Prevent broken Set-Cookie header, because the session_name might be user supplied */ if (strpbrk(PS(session_name), "=,; \t\r\n\013\014") != NULL) { /* man isspace for \013 and \014 */ php_error_docref(NULL, E_WARNING, "session.name cannot contain any of the following '=,; \\t\\r\\n\\013\\014'"); return FAILURE; } The documentation already says it should contain only alphanumeric characters. ### PHP Version PHP 8.2 RC 6 ### Operating System Debian 11.5