php session variables wierd behaviour

Question

I am setting a session variable in PHP as follows:

    $_SESSION['pass'] = $pass;

where $pass is some password, ie. "test4;" The session variable on the left side works fine, but I found to my surpise and concern that $pass on the right side also seems to be a session variable, that is, once set, I can echo $pass from any page and it seems to persist until I destroy the session.

What gives? How can I prevent this?

Thanks!

Well, where does $pass come from?

Pekka
– Pekka

2012-06-08 13:10:49 +00:00
Commented Jun 8, 2012 at 13:10 — Pekka
– Pekka, Commented Jun 8, 2012 at 13:10
Are you running with register globals enabled?

lanzz
– lanzz

2012-06-08 13:11:44 +00:00
Commented Jun 8, 2012 at 13:11 — lanzz
– lanzz, Commented Jun 8, 2012 at 13:11
Maybe somewhere you assign session variable to $pass.

Leri
– Leri

2012-06-08 13:12:02 +00:00
Commented Jun 8, 2012 at 13:12 — Leri
– Leri, Commented Jun 8, 2012 at 13:12

Repox · Accepted Answer · 2012-06-08 13:54:07Z

4

Register globals is probably on - which is a huge security risk! Check to see if this is the case, and make sure it's off. Also, it's a deprecated method.

If register_globals is enabled, you can turn it off either by changing this setting in php.ini OR by placing this in a .htaccess file:

php_flag register_globals off

edited Jun 8, 2012 at 13:54

answered Jun 8, 2012 at 13:12

Repox

15.5k9 gold badges58 silver badges85 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

user1260310 Over a year ago

Where would I find this? The site is hosted remotely on a shared server but I have access to some settings.

Repox Over a year ago

phpinfo(); - it tells you all you need to know.

user1260310 Over a year ago

yes register globals is on. Do you know how to turn it off, ie in what file?

user1260310 Over a year ago

I am getting an Internal Server Error

user1260310 Over a year ago

Update: adding the above flag to the htaccess file caused php to stop working. However, my host lets you edit the php.ini file in the control panel and there is a setting to turn register_globals from on to off. This did the trick and solved problem. Thanks!

Jim · Accepted Answer · 2012-06-08 13:13:32Z

-1

You are assigning the session and the $pass to be equal to each other. Try just using

if(!isset($_SESSION['pass']))

With whatever information you want to validate

answered Jun 8, 2012 at 13:13

Jim

1,3154 gold badges18 silver badges45 bronze badges

1 Comment

Bono Over a year ago

I really don't get what this has to do with OP's question? He's talking that is $pass (not his $_SESSION['pass']) is available everywhere.

Collectives™ on Stack Overflow

php session variables wierd behaviour

2 Answers 2

5 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related