MySQL and SESSION var overlap - PHP Bug?

[BenMo]

I've run into a very weird error.  I found a way to work around the problem, but I don't understand why it was a problem in the first place.

 

I'm creating a login system using SESSION and MySql calls, and there is an overlap in the variables, meaning that it seems php thinks that a $_SESSION var and a $php var are the same variable.

 

session_start();

$myusername=$_SESSION['username'];
$mypassword=$_SESSION['password'];

$host="localhost"; // Host name
$username="BenMo"; // Mysql username
$password="something"; // Mysql password
$db_name="homeBase"; // Database name
$tbl_name="Users"; // Table name

// Connect to server and select databse.
$con = mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

 

What is strange is that the var $_SESSION['username'] gets set to the $username var after this code runs.  So when the page loads, $_SESSION['username'] is storing the value "BenMo", instead of what used to be in the session var. 

 

If I change $username to something else, like $username2, then there isn't a problem.  There isn't code here or anywhere else that assigns a value to the $_SESSION['username'] var. 

 

Does anyone know what's going on?

 

 

[trq]

Does anyone know what's going on?

 

Do you have register globals switched on?

[BenMo]

Hmm, I don't know what register globals are, so perhaps this is the problem.  Any guesses on what the default problem would be if I haven't changed anything?

[trq]

What is the output of....

 

<?php

  echo ini_get('register_globals');

?>

 

?

[btherl]

register_globals would be the default problem if you haven't changed anything   It causes exactly the problem you describe.

 

When the script starts, it sets your standard variables from the values in $_SESSION, $_GET, $_POST and $_COOKIE according to a fixed set of rules (the rules can be changed also, if you're that keen).  Some people like it for the convenience, but it's safer to switch it off if you are able to.

 

And indeed they are the same variables.  If you modify $username, then you will be modifying $_SESSION['username'] (providing it existed in $_SESSION when you called session_start()).  A variable which hasn't been placed in $_SESSION will not magically appear in $_SESSION however, which makes sense.

[BenMo]

Good to know.  Thanks so much!  That was confusing the hell out of me.