Bug #80192 [Com]: session.use_trans_sid brokes JSON encoded HTML string

Edit report at https://bugs.php.net/bug.php?id=80192&edit=1 ID: 80192 Comment by: truongthaietc50 at gmail dot com Reported by: thebetsuno at gmail dot com Summary: session.use_trans_sid brokes JSON encoded HTML string Status: Verified Type: Bug Package: Output Control Operating System: Any PHP Version: 7.3 Block user comment: N Private report: N New Comment: Setting session.use_trans_sid to true in PHP causes the session ID to be automatically added to URLs when encoding HTML content. This can break JSON-encoded HTML strings because the injected session ID disrupts the JSON structure, leading to parsing errors when decoding the JSON on the client side. It's advisable to disable session.use_trans_sid or handle the session ID injection differently to ensure proper JSON decoding and HTML rendering.(https://github.com.php)(https://www.mayoclinicpatientportals.com/) Previous Comments: ------------------------------------------------------------------------ [2020-10-07 08:21:45] cmb@php.net Confirmed: <https://3v4l.org/aRVKl>. ------------------------------------------------------------------------ [2020-10-07 04:21:39] thebetsuno at gmail dot com Description: ------------ Enabled config parameter "session.use_trans_sid" breaks a JSON encoded HTML string. Bug is reproducible in versions 5.6.40, 7.2.33 and I believe in other versions. Test script: --------------- <?php ini_set("session.use_cookies", 0); ini_set("session.use_only_cookies", 0); ini_set("session.use_trans_sid", 1); header('Content-Type: application/json'); echo json_encode('<a href="/test">test</a>'); Expected result: ---------------- "<a href=\"\/test?PHPSESSID=7siuuuk98ns2lps0v1v251f1k3\">test<\/a>" Actual result: -------------- "<a href=\?PHPSESSID=7siuuuk98ns2lps0v1v251f1k3"\/test\">test<\/a>" ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80192&edit=1