Everything

php

References in the session

php.internals

Côme Chilliet

9 years ago

Hello,

In the $_SESSION documentation we can see the following warning: "You can't use references in session variables as there is no feasible way to restore a reference to another variable."
In our application, references where stored in the session and it *seemed to* work fine under PHP5, and it broke with PHP7.

I removed as much references uses as possible, but it’s sometimes hard to guess which objects will end up in the session or not in a complex application.

So, what would help me would be if PHP emit a warning when my code tries to store a reference in the session.
Because right now, it silently fails and I get random errors later when using objects restored from the session.

Is it possible to get such a warning?
If not, is it something that could/should be added?

Silent failing is always a bad option in my opinion.

Côme

Johannes Schlueter

9 years ago

On Wed, 2017-02-22 at 15:01 +0100, Côme Chilliet wrote:

> Hello,
>
> In the $_SESSION documentation we can see the following warning: "You
> can't use references in session variables as there is no feasible way
> to restore a reference to another variable."

Actually with register_globals gone that requirement should be gone so
we should be able to use the same rules as in other serialisation. The
biggest issue is compatibility of the serialized form (during an update
sessions might be shared between different versions of PHP in some
setups, with some persistent storage even longer)

johannes

Yasuo Ohgaki

9 years ago

Hi,

On Thu, Feb 23, 2017 at 10:10 AM, Johannes Schlüter <johannes@schlueters.de>
wrote:

> On Wed, 2017-02-22 at 15:01 +0100, Côme Chilliet wrote:
> > Hello,
> >
> > In the $_SESSION documentation we can see the following warning: "You
> > can't use references in session variables as there is no feasible way
> > to restore a reference to another variable."
>
> Actually with register_globals gone that requirement should be gone so
> we should be able to use the same rules as in other serialisation. The
> biggest issue is compatibility of the serialized form (during an update
> sessions might be shared between different versions of PHP in some
> setups, with some persistent storage even longer)

You may try to use 'php_serialize' as serialize handler to see if it helps.
If your objects work well with __sleep()/__wakeup(), you wouldn't have
issues. If you have, please report issue to bugs.php.net in detail.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net