note 11727 deleted from function.session-register by jimw

Here's security issue wirth knowing about... Suppose you want to check for a valid user using code similar to this: session_start(); session_register("valid"); echo "Authorized=$valid"; The problem is if the user calls the script with test.php?valid=Yes on his first invocation the following 'bad' thing happens: a) $valid hasn't been defined yet by the session b) $valid has been passed in from the URL, thus making it into a global prematurely for our needs c) the register function PRESERVES the newly assigned global So the first time you run this script, the user is valid because they asked to be. The "fault" is thinking that session_register() clears out a global before registering it with the session. Once a variable _is_ registered with the session, then the protection mechanism kicks in and you're fine. This has interesting implications should the user initate a session with some_intermediate_page.php?valid=Yes because those pages may assume the session is already validated and in progress. Consequently, you explictly need to toast any intended session variables before registering them for the first time. One way to do this is to check the value of $PHPSESSID _before_ calling session_start(), and if not assigned a session number, toast the variables; another is to simply unset() all important globals before calling session_start().