local variable overwriting session variable of same name!

is this normal?

[benlieb]

Stored for the session I have:

$session['varName'] = "old string"

On one page I set

$varName = "new string";

I found that now my $session['varName'] is equal to "new string";

Am I crazy? Is this normal? How can this be avoided?

[dreamcatcher]

Hi benlieb,

Should:

$session['varName'] = "old string"

in fact be:

$_SESSION['varName'] = "old string";

Its possibly because of register globals being ON thats causing your variable to be over written. You access the superglobal array using $_SESSION.

dc

[eelixduppy]

It is recommended that you turn register_globals [us3.php.net] off.

[benlieb]

Yes, sorry, of course is should be $_SESSION. I wrote too fast.

My register_globals is on, and it's annoying me. And I have been reading up on the register_globals issue. And it's hard to understand.

Here's what's happening to me:

$_SESSION['user'] = "bob";

echo $_SESSION['user']; // bob
echo $user; // bob

$user = 'sam';

echo $_SESSION['user']; // sam

This is insane! Now everytime I make a local variable I have to worry weather it is overwriting $_SESSION or $_GET? How can I avoid this?

[eelixduppy]

In your php.ini file, scroll down to register_globals = on and change on to off. This will fix your problem.

[benlieb]

I don't have control over the ini, but I was able to turn it off via htaccess. Is that good enough?

I've also noticed that the following will overwrite the _SESSION var:

$_SESSION['name']= "jim";
print ($_SESSION['name']); // jim
$name = "bob";
print ($_SESSION['name']); // bob

But it won't overwrite _GET:

../url/path?name=jim
print ($_GET['name']); //jim
$name = "bob";
print ($_GET['name']); //jim

What is the possible benefit of overwriting the session info? Is this a bug or pure silliness?

[jatar_k]

it is mostly the pure chaos of variable poisoning by having register_globals on

I had no idea it would do that, it should only poison the local variable

this should still output jim both times

$_SESSION['name']= "jim";
print ($_SESSION['name']); // jim
$name = "bob";
print ($_SESSION['name']); // bob

even though register_globals is quite bad I don't think that is how it is supposed to work. What version of php are you using? it might be worth checking [bugs.php.net] if that bug was present in any versions, never heard of it though.

You might want to talk to your host and see if it is an option to turn off register_globals. If it isn't you could look at this page as to some ways of dealing with it

[php.net...]

[benlieb]

I swear this happens on both my local and remote server:

$_SESSION['name']= "jim";
print ($_SESSION['name']); // jim
$name = "bob";
print ($_SESSION['name']); // bob

But even weirder is that it doesn't happen on the first load of the session, only the second load and after! Screw it, I'm getting register_globals off at all costs!

It seems senseless, but I don't really have the time to see if it's a bug or not.