diff --git a/reference/session/reference.xml b/reference/session/reference.xml index 0807c9dbaf..936f622b11 100644 --- a/reference/session/reference.xml +++ b/reference/session/reference.xml @@ -1,5 +1,5 @@ - + Session handling functions Sessions @@ -72,8 +72,9 @@ addditional protections -- this usually comes at a price, reduced convenience for the user. For example, if you want to protect users from simple social engineering tactics, you need to enable - session.use_only_cookies. In that case, cookies must be enabled - unconditionally on the user side, or sessions will not work. + session.use_only_cookies. In that case, + cookies must be enabled unconditionally on the user side, or + sessions will not work. There are several ways to leak an existing session id to third parties. @@ -162,7 +163,7 @@ are accessible like any other variables. - Registering a variable with $_SESSION. + Registering a variable with <varname>$_SESSION</varname>. - Unregistering a variable with $_SESSION and register_globals disabled. + Unregistering a variable with <varname>$_SESSION</varname> and + <link + linkend="ini.register-globals"><literal>register_globals</literal></link> disabled. - Unregistering a variable with register_globals enabled, after - registering it using $_SESSION. + Unregistering a variable with <link + linkend="ini.register-globals"><literal>register_globals</literal></link> + enabled, after registering it using + <varname>$_SESSION</varname>. $_SESSION. - If you are using - $_SESSION - and disable $_SESSION and disable register_globals, do not use session_register, session_is_registered and @@ -305,8 +308,9 @@ else { PHP 4.2 or later, you need to enable it manually when building PHP. Under UNIX, pass --enable-trans-sid to configure. If this build - option and the run-time option session.use_trans_sid are enabled, - relative URIs will be changed to contain the session id automatically. + option and the run-time option + session.use_trans_sid are enabled, relative + URIs will be changed to contain the session id automatically. The arg_separator.output