Question

What happens to object references when they are stored in the session container ($_SESSION)?

In this process, when the values are serialized, are the object references converted into copies or do they simply get broken?

session_start();
$testArrayA = [];
$testArrayB = [];    
$testArrayA["abc"] = &$testArrayB;
$testArrayB["def"] = "test2";
$_SESSION["myvalue"] = $testArrayA;

Thanks alot in advance

Answer 1

When the session is written, it gets serialized. Serialization does not care about references at all since it just reads the data (if it’s reading from a reference it will resolve the reference’s target).

You can see this behavior by changing the last line to:

var_dump(serialize($testArrayA));

string(44) "a:1:{s:3:"abc";a:1:{s:3:"def";s:5:"test2";}}"

That’s what gets stored in the session.

Note that if an object implements __sleep or the Serializable interface its serialization behavior is unique. I believe that PDO overrides serialization behavior to destroy its database connection reference.