note 10915 deleted from ref.session by sander
| From: | sander@php.net | Date: | Sun, 07 Apr 2002 11:36:22 +0000 |
| Subject: | note 10915 deleted from ref.session by sander | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-28853@lists.php.net to get a copy of this message | ||
Huge security hole if you have session.auto_start = 0 and session globals enabled. You MUST unset
each variable before you start the session and register them or users are going to be able to set
them on the first run. I actually think that session_register should clear globals if they are not
already session variables.