Question

print_r($_SESSION);

gives me this:

[post] =>
[verify] => 3bae5359ea60d7f00d553ae5d091ae4b
[token] => 

token is set, but null, right? When I implement this:

if (!isset($_SESSION['token'])) {
    die("Token not set");
}

The script dies. Why is this happening?

Answer 1

From the documentation –

bool isset ( mixed $var [, mixed $… ] )

isset determines if a variable is set and is not NULL

Also –

Return Values: Returns TRUE if var exists and has value other than
NULL, FALSE otherwise.

So, if the supplied argument contains NULL or if it simply doesn’t exist, then isset will return FALSE. This is exactly what is happening with your script and as a result, it dies.