Hi all,

Current session module has a few limitations due to "register_globals"
support which is now obsolete. One of them is numeric key indexed session
data. i.e. $_SESSION[1] = $var is not allowed now and it raises error at
R_SHUTDOWN with useless message for debugging.

https://bugs.php.net/bug.php?id=65359

Following patch (diff against 5.5 branch) add php_serialize session
serialize handler and removes the limitation. To test patch, set
"session.serialize_handler = php_serialize" in php.ini file or set it via
ini_set().

https://gist.github.com/yohgaki/6171628
(All tests and my new test for new serializer passed with Valgrind)

It's possible to remove unneeded limitation from current serializers, but
it causes BC. (e.g. AFAIK, perl and python have serializer/unserializer for
PHP session data. If we simply remove limitation, session data decode may
fail.)  Therefore, adding new serializer would be better.

Since it uses plain serialize(), users may simply unserialize() to inspect
session data if it is needed. Users may setup initial $_SESSION array from
serialize()ed data. i.e. session_decode($serialized_data) These would be
useful for some users.

I would like to add this new serializer to 5.5(optional) and
master(default).

Any comments?

--
Yasuo Ohgaki
yohg...@ohgaki.net

Reply via email to