note 62381 deleted from security.globals by philip
| From: | philip@php.net | Date: | Fri, 28 Apr 2006 16:52:46 +0000 |
| Subject: | note 62381 deleted from security.globals by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-110023@lists.php.net to get a copy of this message | ||
Note Submitter: rn214 at cam dot ac dot uk
----
If you have a server with register_globals = On, and you want to simulate turning it off, then there
is a serious problem with $_SESSION.
To fix it, you must do
$unset = array_keys($_SESSION);
foreach($unset as $rg_var){
if(isset($$rg_var)){
unset($$rg_var);
}
}
AFTER you have called session_start().
Otherwise, you will have pairs of variables $_SESSION["foo"] and $foo
which are "hard-linked" together. They are not simply initialised to the same value:
modifying $_SESSION["foo"] will also modify $foo.