note 45534 added to ref.session

Although this IS mentioned in the PHP manual, it is not very clear and can lead to some very hard to track down bugs. When REGISTER_GLOBALS is ON on a server, local variables of the same name as a session variable can leak their values into the session during a POST or GET. For example, if you run script "SESS_TEST1.PHP" below, the local var $animal will bleed its value of "I am an Elephant" into the session variable $_SESSION['animal'], which should have a value of "I am a Monkey". Beware! <?php // SESS_TEST1.PHP session_start(); $_SESSION['animal'] = 'I am a Monkey'; $animal = 'I am an Elephant'; $value = 249; echo "<script>window.location=\"sess_test2.php". "?animal=$animal&value=$value\"</script>"; ?> <?php // SESS_TEST2.PHP session_start(); $animal = $_REQUEST['animal']; $value = $_REQUEST['value']; echo "SESSION['animal'] = ".$_SESSION['animal']." (should say \"I am a Monkey\")<br/>"; echo "\$animal = ".$animal."<br/>"; echo "\$value = ".$value."<br/>"; ?> ---- Manual Page -- http://www.php.net/manual/en/ref.session.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+45534 Delete -- http://master.php.net/manage/user-notes.php?action=delete+45534&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+45534&report=yes Search -- http://master.php.net/manage/user-notes.php