From 0fd67c018cb504efaa3b4bf780df9f1a4e489fe7 Mon Sep 17 00:00:00 2001 From: Sascha Schumann Date: Thu, 3 Oct 2002 07:54:36 +0000 Subject: [PATCH] Bring documentation a bit closer to reality git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@97895 c90b9560-bf6c-de11-be94-00142212c4b1 --- reference/session/reference.xml | 124 ++++++++++++++++---------------- 1 file changed, 60 insertions(+), 64 deletions(-) diff --git a/reference/session/reference.xml b/reference/session/reference.xml index db61a4adcd..5b4273e4bd 100644 --- a/reference/session/reference.xml +++ b/reference/session/reference.xml @@ -1,5 +1,5 @@ - + Session handling functions Sessions @@ -112,52 +112,32 @@ As of PHP 4.1.0, $_SESSION is available as global variable just like $_POST, $_GET, $_REQUEST and so on. - Not like $HTTP_SESSION_VARS, - $_SESSION is always global. Therefore, - global should not be used for - $_SESSION. + Unlike $HTTP_SESSION_VARS, + $_SESSION is always global. Therefore, you do not + need to use global for + $_SESSION. Please note that this documentation + has been changed to use $_SESSION everywhere. You can + substitute $HTTP_SESSION_VARS for + $_SESSION, if you prefer the former. If track_vars is - enabled and register_globals is disabled, only members of the global associative array - $HTTP_SESSION_VARS can be registered as session + $_SESSION can be registered as session variables. The restored session variables will only be available - in the array $HTTP_SESSION_VARS. - - - Registering a variable with <link - linkend="ini.track-vars"><literal>track_vars</literal></link> - enabled - - - -]]> - - + in the array $_SESSION. Use of $_SESSION (or $HTTP_SESSION_VARS with PHP 4.0.6 or less) is - recommended for security and code readablity. With - $_SESSION or - $HTTP_SESSION_VARS, there is no need to use + recommended for improved security and code readablity. With + $_SESSION, there is no need to use session_register()/session_unregister()/session_is_registered() - functions. Users can access session variable like a normal - variable. + functions. Session variables are accessible like any other + variables. Registering a variable with $_SESSION. @@ -178,7 +158,7 @@ if (!isset($_SESSION['count'])) { </example> <example> <title> - Unregistering a variable with $_SESSION. + Unregistering a variable with $_SESSION and register_globals disabled. +]]> + + + + + Unregistering a variable with register_globals enabled, after + registering it using $_SESSION. + + + ]]> @@ -195,21 +190,21 @@ unset($_SESSION['count']); If register_globals is enabled, then all global variables can be registered as session - variables and the session variables will be restored to - corresponding global variables. Since PHP must know which global - variables are registered as session variables, users must register - variables with session_register() function while - $HTTP_SESSION_VARS/$_SESSION - does not need to use session_register(). + variables and the session variables will be restored to corresponding + global variables. Since PHP must know which global variables are + registered as session variables, users need to register variables with + session_register() function. You can avoid this by simply setting entries + in $_SESSION. If you are using - $HTTP_SESSION_VARS/$_SESSION + $_SESSION and disable register_globals, do not use session_register, session_is_registered and - session_unregister. + session_unregister, if your scripts shall work + in PHP 4.2 and earlier. You can use these functions in 4.3 and later. If you enable register_globals - is recommended for both security and performance reason. + is recommended for both security and performance reasons. @@ -243,20 +238,21 @@ else { - If both track_vars and - register_globals - are enabled, then the globals variables and the - $HTTP_SESSION_VARS/$_SESSION - entries will reference the same value for already registered - variables. + is enabled, then the global variables and the + $_SESSION entries will automatically reference the + same value for session variables which were registered in prior session + instances. - If user use session_register() to register session variable, - $HTTP_SESSION_VARS/$_SESSION - will not have these variable in array until it is loaded from - session storage. (i.e. until next request) + Additionally, if you register a new session variable by using + session_register(), the entry in the global scope + and the $_SESSION entry will not reference the same + value until the next session start (this applies to PHP 4.2 and before + only). I.e. a modification to the global variable will not be reflected + by the $_SESSION entry. This is unlikely to matter in + practice and has been corrected in PHP 4.3. @@ -284,15 +280,15 @@ else { session id directly into URLs. - PHP is capable of doing this transparently when compiled with - - --enable-trans-sid. If you enable this option, - relative URIs will be changed to contain the session id - automatically. Alternatively, you can use the constant - SID which is defined, if the client did not - send the appropriate cookie. SID is either of - the form session_name=session_id or is an empty - string. + PHP is capable of doing this transparently if compiled with + --enable-trans-sid. This option is always + enabled in PHP 4.2 and later. If you enable this option, relative URIs + will be changed to contain the session id automatically. Alternatively, + you can use the constant SID which is defined, if the + client did not send the appropriate cookie. SID is + either of the form session_name=session_id or is an + empty string. The arg_separator.output