note 89381 added to function.session-set-save-handler

A bit more information on what patrick at eternalspace dot com stumbled upon (and I have just now as well)... The "binary" data that is in the session data appears to surround class/object names, and if you pass your session data through a function to sanitize it for SQL injection, you may indeed run in to problems. For example, using the PDO::quote() function to prepare the data for injection (in my case for SQLite3), it was stopping short as soon as it encountered the first bit of binary data, causing my session information to be corrupted. This change *must* have happened somewhere in the 5.2 series, because I just started encountering this problem recently on a code base that had been tested & working on earlier versions of PHP 5.2. This may in fact be a bug - I have not yet checked... but beware, and perhaps using base64 to encode/decode your session data is a good thing to do just to be sure (though you are now left unable to visually inspect serialized session information at the storage level which is a rather big problem for on-the-fly debugging of sessions). ---- Server IP: 69.147.83.197 Probable Submitter: 99.241.132.158 ---- Manual Page -- http://www.php.net/manual/en/function.session-set-save-handler.php Edit -- https://master.php.net/note/edit/89381 Del: integrated -- https://master.php.net/note/delete/89381/integrated Del: useless -- https://master.php.net/note/delete/89381/useless Del: bad code -- https://master.php.net/note/delete/89381/bad+code Del: spam -- https://master.php.net/note/delete/89381/spam Del: non-english -- https://master.php.net/note/delete/89381/non-english Del: in docs -- https://master.php.net/note/delete/89381/in+docs Del: other reasons-- https://master.php.net/note/delete/89381 Reject -- https://master.php.net/note/reject/89381 Search -- https://master.php.net/manage/user-notes.php