Session overidden by $variable with same name?

move3rd

When a member (artist) logs into my members area their name is set as a session variable $_SESSION['artist'];

My index page extracts a random $artist from my db for display to the general public.

When member visits the index page while logged in there $_SESSION['artist'] variable is overwritten by the $artist variable.

Is this becouse i have registar globals on?

bretticus

unless you are setting $_SESSION['artist'], I don't see how. In fact, that's one of the purposes of of a superglobal (so you get the intended value always.)

Wierd, can you post your code?

move3rd

There's to much code (messy!) to post. I'm using a modded verion of cubecart. I know it was written for use with register globals on. The php manual says it's best not to use session_register() and $SESSION[''] together so I have replaced session_register()'s with $SESSION['']'s.

There is no referance to $_SESSION['artist']; or session_register(artist) in my index.php only $artist (pulled from the db).

This is whats in my session when I login as 'this_artist' :

Values submitted via SESSION method:
artist => this_artist
user => this_username

When I go to my index page$artist = this_other_artist is used to display a random artist.

Values submitted via SESSION method still shows:
artist => this_artist
user => this_username

I refresh the page then values submitted via SESSION method now shows:
artist => this_other_artist
user => this_username

Hope you can follow that..

I've checked every file include to make sure there is nothing overwitting the $_SESSION['artist'] and I can not find anything. I'll keep going over it....

move3rd

I've been going over this for seven hours now and I still havent managed to find out how/why the session variable is being overwritten..

Any idears?

move3rd

Just found this comment in the manual:

Although this IS mentioned in the PHP manual, it is not very clear and can lead to some very hard to track down bugs.

When REGISTER_GLOBALS is ON on a server, local variables of the same name as a session variable can leak their values into the session during a POST or GET.

For example, if you run script "SESS_TEST1.PHP" below, the local var $animal will bleed its value of "I am an Elephant" into the session variable $SESSION['animal'], which should have a value of "I am a Monkey". Beware!

<?php
// SESS_TEST1.PHP
session_start();
$_SESSION['animal'] = 'I am a Monkey';
$animal = 'I am an Elephant';
$value = 249;

echo "<script>window.location=\"sess_test2.php".
  "?animal=$animal&value=$value\"</script>";
?>

<?php
// SESS_TEST2.PHP
session_start();
$animal = $_REQUEST['animal'];
$value  = $_REQUEST['value'];

echo "SESSION['animal'] = ".$_SESSION['animal']." (should say \"I am a Monkey\")<br/>";
echo "\$animal = ".$animal."<br/>";
echo "\$value = ".$value."<br/>";
?>

Is there a way to avoid this without having to rename all my session variables?

bretticus

Huh, I have register_globals set to ON on my server (not my choice had to support old code...aaarrrgghhh!!!) and I've never experienced that, however, it's possible I just have used different variable names. Either way, that's good to know. Thanks!

Can you turn register_globals off using ini_set()?

move3rd

As I said my site is a modded cubecart which requires registar globals to be on.

Looks like I'll have to think up some fancey names for my variables!