Question

We are using Zend Framework 1.7 on a project (old, I know) and just made a change to move the session data from files to the database. This appears to be working fine in both environments we deployed it in.

However, there is one big difference: in environment A (PHP 5.2), the session data is being stored in a plaintext serialized format, e.g.:

key|[php serialized array]

In environment B (PHP 5.3), the data appears to be getting base64 encoded somehow:

IpgJ4fbSZ0v2qi4RmGcgQ9tP7YEUyN1R9-7oroGl4071fnlk_UVkkrkUcpdHdw_UsRYy-6NpL61gTuL2Htcmv3HU5UM3ClwSDndY40kyimDPs3SdS7gNHwhwdpailLOfrIxqV48hZDhNHKlIpSX2QZm0jOHjRhZc2kjXnMgqioLqJiDdgyUCRnqKcZ_ZtBISq8BAZARW61P5Ls_ZSO506ltuNqIJIJGkV2R7qvDKLLCtxUQUwd7P8IlJiC7iq_Q4GIn3gMr0KwAHLP6adzxSusVk5begrx9lBk9Dxp8KkJ8Gx8rfKJfvVBIJKZgmsFsWq41dV0J4y1Lgihvx9nU73g..

Both environments appear to be working otherwise, but I need to make sure we understand why this is happening, and I can’t seem to find any documentation or similar situation anywhere. My assumption is that the difference in PHP version and/or configuration in php.ini is influencing it, but I am at a loss as to how.

Answer 1

I had the same problem today on a clustered server, in one I had php 5.2 and in the other php 5.3.

My initial guess was also a version problem, but I found so far that suhosin was the problem since was encrypting the session.

You can decrypt the session, just in the machine it was encrypted; to do you you should change the following in your php.ini:

suhosin.session.encrypt = on
suhosin.cookie.encrypt = on
session.save_handler = files
session.save_path = /tmp

and later write a script like:

$data = $argv[1];
$sessid = 'recovering';
file_put_contents("/tmp/sess_{$sessid}", $data);

session_id($sessid);
session_start();
print_r($_SESSION);

Which will only copy the encrypted string into a sess file and print contents (you can serialize to match the normal session behavior)

Of course if you want later that php don’t encrypt through suhosin, you need to set .encrypt = off