[doc-en] master: docs(session): replace register_globals key limits with explicit rules (#5888)

Author: Satvik Mishra (SatvikMishra08) Committer: GitHub (web-flow) Pusher: lacatoire Date: 2026-09-29T07:51:10+02:00 Commit: https://github.com/php/doc-en/commit/211645e4fc10c688b3813dbcce05965a5f95f00e Raw diff: https://github.com/php/doc-en/commit/211645e4fc10c688b3813dbcce05965a5f95f00e.diff docs(session): replace register_globals key limits with explicit rules (#5888) * docs(session): replace register_globals key limits with explicit rules The session intro still said serialize handlers inherit register_globals limitations, but that topic no longer exists. Document the actual root-level $_SESSION key restrictions for the php/php_binary handlers (and that nested keys and php_serialize are unaffected). Fixes #4448 * docs(session): use simpara for inline-only session key notes --------- Co-authored-by: Satvik Mishra <SatvikMishra08@users.noreply.github.com> Co-authored-by: Satvik Mishra <satvikmishra08@gmail.com> Changed paths: M reference/session/book.xml Diff: diff --git a/reference/session/book.xml b/reference/session/book.xml index c4071a638c29..c05f24a7f0d0 100644 --- a/reference/session/book.xml +++ b/reference/session/book.xml @@ -52,15 +52,36 @@ Because session data is serialized, <type>resource</type> variables cannot be stored in the session. </para> - <para> - Serialize handlers (<literal>php</literal> - and <literal>php_binary</literal>) inherit register_globals - limitations. Therefore, numeric index or string index contains - special characters (<literal>|</literal> - and <literal>!</literal>) cannot be used. Using these will end up - with errors at script shutdown. <literal>php_serialize</literal> - does not have such limitations. - </para> + <simpara> + The <literal>php</literal> and <literal>php_binary</literal> + serialize handlers place restrictions on + <emphasis>root-level</emphasis> keys in + <varname>$_SESSION</varname>. Nested keys inside arrays or objects + stored in the session are not subject to these restrictions. + The following root-level keys are not allowed: + </simpara> + <itemizedlist> + <listitem> + <simpara> + Numeric keys (for example <literal>$_SESSION[0]</literal>). + Such keys are skipped when the session is written, and a warning + is emitted. + </simpara> + </listitem> + <listitem> + <simpara> + String keys that contain <literal>|</literal> when using the + <literal>php</literal> serialize handler. Using such a key causes + session write failure (and a warning as of PHP 8.5.0). + </simpara> + </listitem> + </itemizedlist> + <simpara> + The <literal>php_serialize</literal> handler does not have these + limitations, and may be used when numeric keys or keys containing + <literal>|</literal> must be stored at the root of + <varname>$_SESSION</varname>. + </simpara> </warning> <note> <para>