'register_globals' and $_SESSION

[carpeliam]

Everything was fine on my personal system until I uploaded to the remote server... then my sessions stopped working. I realized that on the remote server, register_globals was set to "on", whereas it's set to "off" on my personal system.

So.. when I try the following:

$_SESSION['user'] = $id;

this works on my personal system with register_globals = Off, but on my remote system, $_SESSION['user'] is upcast to an object of type stdClass on the next page/request. I read somewhere in the docs that this can happen when serializing an object without including type information, and that session vars are serialized and deserialized.

I see a few choices in front of me... either I go with ini_set("register_globals&quot on every page, or session_register("id&quot and use $id on every page. I'd rather not do either... I don't want to have to change an config value all the time, nor do I want to use a global variable like $id when I have a perfectly good global array $_SESSION.

Is there a third alternative (or a 4th, 5th, or 6th)? Which would someone recommend?

Thanks all... Liam Morley
lmorley@gdc.wpi.edu
"light the deep, and bring silence to the world.
light the world, and bring depth to the silence."

 

[gerrygerry]

how about:

 $user = $id;
 session_register('user');

will that solve the problem?

from what i understood in your post, this doesn't seem like a major problem... am i missing something?

hope i helped! -gerrygerry
Go To

http://quickfreewebsite.com!

 

[AnakinPt]

well, for safety reasons you should have register_vars set to false.

to use session vars, you should use $_SESSION[varname]. Using this, you DON'T NEED to register the varname cause is automaticaly registered.

check if the PHP version in the webserver is 4.1.x or later, cause $_SESSION only appeared in 4.1.0 version. Anikin
Hugo Alexandre Dias
Web-Programmer
anikin_jedi@hotmail.com

 

[carpeliam]

I'm not the system admin, so I can't edit the php.ini.. there are other users on the machine that rely on register_globals. (I assume that's what Anikin meant, as there doesn't seem to be a "register_vars" ini setting.)

gerrygerry, yep, it seems like that's all I can try... and it works.. it's not a major problem.. but.. it's not the desired solution I talked to the sys admin, and they were actually in favor of turning register_globals off, as long as it didn't hurt anybody. It seems that we might be able to get him to change his code..

The version of PHP is sufficiently up to date. Liam Morley
lmorley@gdc.wpi.edu
"light the deep, and bring silence to the world.
light the world, and bring depth to the silence."