PHP session variables interchanged with local variables?

Question

I've encountered a very odd issue in regards to session variables and local variables in php.

I'm trying to figure out if I am not understanding something about sessions in php or if this is an issue with the php version my host is using.

Here is a very simple code to demonstrate the weird issue:

session_start();  
var_dump($kenny);  
var_dump($_SESSION['kenny']);  
$_SESSION['kenny']='def';  
var_dump($kenny);  
var_dump($_SESSION['kenny']);  
$kenny = 'abc';  
var_dump($kenny);  
var_dump($_SESSION['kenny']);  

The first time I run the code, I get the following results (as one would expect):

NULL NULL NULL string(3) "def" string(3) "abc" string(3) "def"

I run it a second time (without closing my browser, of course), I get this now!

string(3) "def" string(3) "def" string(3) "def" string(3) "def" string(3) "abc" string(3) "abc" 

I run it a 3rd, 4th, 5th time and so on, I get this!!!

string(3) "abc" string(3) "abc" string(3) "def" string(3) "def" string(3) "abc" string(3) "abc" 

It looks to me like the session variable 'kenny' and local variable $kenny become aliases to one and the other after running the script more than once. hmm... I really don't think this is how session variables and local variables work in php. Please correct me if I'm missing something here.

My web host is running php 5.2.2. When I try this exact same code on other hosts running php 5.2.1, 5.2.14 and 5.3.1, they always give me what I expect:

1st time:

NULL NULL NULL string(3) "def" string(3) "abc" string(3) "def"

thereafter:

NULL string(3) "def" NULL string(3) "def" string(3) "abc" string(3) "def" 

I checked the change log on php.net and didn't find anything that I can relate to that may address this issue. But like I mentioned, an earlier build (5.2.1) works ok, so that's very puzzling to me.

If anyone runs any other version of php 5.2.x, please give it a try and let me know if you see the same issue. Or if anyone has any insight into the issue, I'd really appreciate any feedback.

Thanks a million!

Answer 1

This is probably because the register_globals directive is on. It doesn't say it on that page that $_SESSION variables are included, but it says here:

If register_globals is enabled, then the global variables and the $_SESSION entries will automatically reference the same values which were registered in the prior session instance. However, if the variable is registered by $_SESSION then the global variable is available since the next request.