session_start() issues regarding illegal characters, empty session ID and failed session

Question

So, I realise this is a repeat question however, it is apprently a bug yet the original post for this is 5 years old but it\'s also said that it\'s a malicious

Answer 1

I like the explanation of Pedro Lobito but the algorithm can be improved:

if (isset($_COOKIE[session_name()]) && 0 === preg_match('/^[-,a-zA-Z0-9]{1,128}$/', $_COOKIE[session_name()])) {
    unset($_COOKIE[session_name()]);
}

if ('' === session_id()) {
    session_start();
}