Weird PHP behavior if I put exclamation point into variable name

Question

I have weirdest problem with PHP itself, that I\'ve ever seen.

Setup:

PHP 5.33, (tried PHP 5.2.14 as well) under IIS

Problem

Answer 1

It's not Windows, it's not Apache or any other webserver, it is PHP core.

I had a look at it - starting from 5.3 to 5.6 and the problem still exists in there: You are not allowed to have an "!" (exclamation mark) or "|" (pipe) inside the session key.

The Suhosin patch will fix it partially. You are then allowed to have an exclamation mark at any position inside your key, but not at first position, so "foo!" is allowed, but not "!foo". A pipe is still forbidden.

The fix:

1. Change session.serialize_handler in your php.ini to php_binary or php_serialize
2. Restart the webserver.

Have fun!

Answer 2

well what is your question about? what is the reason of this error or how to avoid it?
A first one is probably because of some odd PHP internals. For example, you cannot use numeric keys with same consequences.
A latter one is even simpler - do not put exclamation point into a key in session array.

As I recall, PHP sessions mechanism came up from the PHPLib - a first PHP framework ever. Written by some volunteer students. Not a very optimal one. Once added to PHP in the version 4.0, become usable only at 4.1 but still with some odd legacy, like register_globals support. The latter one is most likely the reason of your problem. $_SESSION array key must be valid PHP variable name, in sake of that ancient register_globals behavior where session variables become global PHP variables.