timothyb89 Posted June 20, 2008 Share Posted June 20, 2008 I've been confused about some errors that I've been getting lately, and I've finally found the cause. Apparently, variables stored in $_SESSION['xxx'] are being overwritten when you assign a value to $xxx. This is particularly annoying with local variables with names like $user, that are commonly used on the website. Is there any way to prevent this, or does anyone have a recommendation on ways of getting around this? -Thanks! Link to comment https://forums.phpfreaks.com/topic/111182-preventing-_session-variables-from-being-overwritten/ Share on other sites More sharing options...
papaface Posted June 20, 2008 Share Posted June 20, 2008 Turn off register globals. Link to comment https://forums.phpfreaks.com/topic/111182-preventing-_session-variables-from-being-overwritten/#findComment-570645 Share on other sites More sharing options...
PFMaBiSmAd Posted June 20, 2008 Share Posted June 20, 2008 Yes. You have discovered what was wrong with register_globals. Someone can also visit your site with ?xxx=myvalue on the end of the URL and set $_SESSION['xxx'] = myvalue. Your host should not have register_globals turned on (this problem has been known since 2002 and register_globals have been turned off by default since then and they have been completely removed in php6.) Either turn register_globals off if you can or rename your variables to have unique names. Link to comment https://forums.phpfreaks.com/topic/111182-preventing-_session-variables-from-being-overwritten/#findComment-570653 Share on other sites More sharing options...
timothyb89 Posted June 20, 2008 Author Share Posted June 20, 2008 I couldn't turn it off, but I found a function that unsets all of the registered variables, and everything is working perfectly. Thanks for the help! Link to comment https://forums.phpfreaks.com/topic/111182-preventing-_session-variables-from-being-overwritten/#findComment-570656 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.