PHP: why does session_encode() cutoff output?

Question

I think the root of the problem is my understanding of string handling. serialize($_SESSION) does the same thing. My session file goes on for 5kb, but when I output session_encode() to the log or to a database, it cuts off after about 100 bytes.

    $s = session_encode();
    $n = strlen($s);
    error_log("Session ($n): $s");

I get:

Session (5948): return_url|s:30:"https://solution-locale/Moneys";complete|s:0:"";basket|O:15:"SolutionUBasket":22:{s:13:

When I try writing the value to the database (pg_execute()--that's a prepared statement) I get the same problem. But when I do a bin2hex(), I learn that after that last ":" there's a null character (0x00).

So clearly the problem is string handling, and I'm not doing it right.

And the db-writing code is the following:

pg_prepare($this->getCnx(), $token, $sql);
pg_execute($this->getCnx(), $token, $values);

$sql is:

UPDATE "solution_ubasket_temp" SET ("session_id", "session", "id") = ($1, $2, $3) WHERE "id"=$4"

$values is just an array. strlen() operations on it confirms that all 5kb get into the session member.

The update goes ahead without error messages, but the "session" field gets cut off just like the in the debug.

select length(session), * from solution_ubasket_temp

confirms that "session" gets cutoff after 105 bytes.

The "session" column is a text but changing it to a bytea didn't help.

select octet_length(session), * from solution_ubasket_temp

confirms that.

I'm running PHP 5.6 on Debian 8.5.

The PHP manual warns you for the error_log function: Warning error_log() is not binary safe. message will be truncated by null character. (php.net/manual/en/function.error-log.php) — Jeremy Harris
– Jeremy Harris, Commented Dec 22, 2016 at 16:00
Not sure this has been spelled out clearly enough, so to avoid going off in the wrong direction here: the serialised data contains a NUL byte. That is in itself not a problem that requires fixing. Only: 1) error_log in particular cannot correctly deal with NUL bytes, which is why your debugging method fails; 2) Postgres can deal with NUL bytes just fine if you handle them correctly. You'll have to show us what exactly you're doing with pg_execute for us to help you with that part of the problem. — deceze
– deceze ♦, Commented Dec 22, 2016 at 16:18

Community · Accepted Answer · 2017-05-23 12:08:56Z

0

I think that the question was wrong. It's not a matter of session_encode() cutting it off, but the fact that some PHP routines might not be able to handle the binary strings that the function produces. So, bottom line: if you use session_encode(), make sure whatever routines that handle the return value can deal w/it. So far, I've found that error_log() and pg_execute() cannot.

This was made clearer here: PHP/PostgreSQL: writing binary data with prepared statements

edited May 23, 2017 at 12:08

CommunityBot

11 silver badge

answered Dec 23, 2016 at 19:09

Opux

8062 gold badges11 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP: why does session_encode() cutoff output?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related