Question

here is the code I am trying to execute, it was working fine on my localhost and another server PHP Version 5.3.2-1ubuntu4.11 but this creates problem in PHP Version 5.2.17 on a shared hosting

<?php
/* PHP version PHP Version 5.2.17   
 * Server API   CGI/FastCGI
 */
session_start();
$products = array();
if (!isset($_SESSION['products'])) {
    $products = array("somedata1", "somedata2", "somedata3");
    $_SESSION['products'] = serialize($products);
    $_SESSION['test_products'] = serialize($products);
    echo "<br/>session products<br/>";
    print_r(unserialize($_SESSION['products']));
    echo "<br/>session test_products<br/>";
    print_r(unserialize($_SESSION['test_products']));
} else {
    echo "<br/>session products<br/>";
    print_r(unserialize($_SESSION['products']));
    echo "<br/>session test_products<br/>";
    print_r(unserialize($_SESSION['test_products']));
}
?>

On first run outputs

session products
Array ( [0] => somedata1 [1] => somedata2 [2] => somedata3 ) 
session test_products
Array ( [0] => somedata1 [1] => somedata2 [2] => somedata3 )

but on reloading

session products

Warning: unserialize() expects parameter 1 to be string, array given in /home/uaustral/public_html/itoi/test.php on line 17

session test_products
Array ( [0] => somedata1 [1] => somedata2 [2] => somedata3 )

Same code works fine on my PHP version PHP Version 5.3.2-1ubuntu4.11

Am I missing something (that is automatically corrected in new PHP version) or is it a PHP bug for the old version ?

Answer 1

If you work with register_globals enabled, any array-item in $_SESSION is also known as a variable by that key:

With register_globals on:

<?php
session_start();
var_dump($products);

Should show you the unserialized string. Because you later say $products = array(); you are implicitly altering $_SESSION['products']. Solution: disable register_globals, and on a side note: you don’t need to serialize that data, a session can hold multi-dimensional arrays just fine. Just make sure to have any needed class-definitions loaded before calling session_start, or have an autoload function.