Drei Tage lang wäre ich fast verzweifelt, als ich eine WordPress-Seite um ein selbstgeschriebenes Login-Script erweitern wollte. Lokal funktionierte alles einwandfrei, doch sobald ich es hochgeladen hatte, schienen die Session-Variablen nicht mehr übernommen zu werden: nach dem Login war man jeweils einen Klick lang eingeloggt und danach sofort wieder ausgeloggt.
Nach etlichen erfolglosen Google-Suchen (im Nachhinein googelt es sich ganz leicht danach, aber versucht mal was dazu zu finden, nachdem Ihr nicht weiter als bis hierher gelesen habt) fand ich endlich die Ursache, nämlich die Funktion wp_unregister_GLOBALS() in der Datei wp-settings.php. Hier ist sie:
function wp_unregister_GLOBALS() {
if ( !ini_get('register_globals') )
return;
if ( isset($_REQUEST['GLOBALS']) )
die('GLOBALS overwrite attempt detected');
// Variables that shouldn't be unset
$noUnset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES', 'table_prefix');
$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
foreach ( $input as $k => $v )
if ( !in_array($k, $noUnset) && isset($GLOBALS[$k]) ) {
$GLOBALS[$k] = NULL;
unset($GLOBALS[$k]);
}
}
Was macht diese Funktion?
- Zeile 27/28:
Wenn auf dem Webserver die PHP-Einstellungregister_globalsnicht aktiviert ist, dann macht sie überhaupt nichts (daher auch die unterschiedlichen Verhaltensweisen meines Scripts auf meinem lokalen und dem Live-Server). Istregister_globalsjedoch aktiv, geht es folgendermaßen weiter:- Zeile 34:
Wie der Kommentar schon sagt, werden hier alle globalen Variablen aufgelistet, die nicht resettet werden sollen. Wie man sieht, ist$_SESSIONnicht dabei! - Zeile 36-41:
Nun werden nacheinander alle globalen Variablen durchgegangen und gelöscht.
- Zeile 34:
Kurz gesagt: Wenn register_globals aktiviert ist, wird $_SESSION bei jedem Seitenaufruf gelöscht. Kein Wunder also, daß man nicht mehr an seine Session-Variablen rankommt!
Wozu das Ganze?
Nun ja, zum einen geht WordPress davon aus, daß es sich komplett um jeden Bereich der Seite kümmern soll – schließlich ist es ja eine Art von Content-Management-System. Und das beinhaltet eben auch, daß es die Verwaltung sämtlicher Variablen übernimmt.
Was aber noch viel wichtiger ist, ist die Tatsache, daß die Verwendung von register_globals längst veraltet ist und das Feature mit PHP 6 sogar komplett entfernt wird. Von der Programmierung mit solchen Variablen wird inzwischen überall abgeraten, da sie Sicherheitsrisiken birgt. WordPress versucht also offensichtlich, das Verhalten von deaktiviertem register_globals nachzuahmen, um die Sicherheit zu erhöhen und eventuelle Variablenkonflikte zu vermeiden.
Abhilfe
Nachdem ich erst einmal hinter dieses Rätsel gekommen war, lag die Lösung natürlich auf der Hand: Ich muß register_globals auf dem Webserver deaktivieren, damit WordPress diese bescheuerte Funktion gar nicht erst auszuführen braucht. Dazu lädt man einfach in sein WordPress-Verzeichnis eine Textdatei namens php.ini hoch, in der die folgende Zeile steht:
register_globals Off
Weitere Informationen zum Thema gibt es auf php.net:
73 Antworten zu “Session-Variablen in WordPress”
You’re right, this can vary from host to host: Sometimes you have to upload a
php.inias described, sometimes you can do it in.htaccessas you just said, and sometimes there’s a checkbox in the Admin panel where you can turn offregister_globals. :)Hey there, I found your site racking my brain trying to find a good solution. While I did try the solution you propose, it did not work for me.
I did a bit more searching and came across this blog post:
http://www.frank-verhoeven.com/using-session-in-wordpress/
The solution he provides works perfectly, allows the use of $_SESSION within your wordpress site, and is upgrade compatible.
Thanks,
-Ivan
Oh – well, yes, I thought it was somewhat self-evident that you have to put
session_start()somewhere before you can start working with sessions. :) My solution was especially for those cases whensession_start()has already been added to a WP file likewp-config.php, and it still doesn’t work.But you are right, I should have mentioned that. Thanks for the link, it’s a good guide.
Hi all! I am developing a theme for commercial use and require sessions to run to add some functionality that is needed.
At the moment wp_unregister_GLOBALS() seem to be a great problem for me, since modifying wp-setting.php manually is not an option. Has anyone got any ideas on how to add SESSIONS global variable to a $noUnset list, by coding only inside my theme folder? Or maybe desable wp_unregister_GLOBALS()? Or perhaps deactivate register_globals in php setting file of the server? But remember I am limited to doing that by code only from inside my theme folder. Any advise on this will be much appreciated, I’ve been trying to find a solution for a week now and getting very frastrated at wordpress…
Cheers
Max
The cleanest and most logical solution is, as I wrote, to disable register_globals. You could try to add a
php.iniwithregister_globals Offto your theme folder, but it’s not granted that it will work from there, and certainly not on every server, because the way PHP ini values are set vary a lot depending on the host. (Some use aphp.inifile, others only allow these settings to be changed from an admin panel, etc.)Another idea I have right now is: Perhaps you could override
wp_unregister_GLOBALS()in your functions.php using override_function(). Just replace it with an empty function. Actually, that’s a pretty neat idea I just had there! Tell me how it worked out. ;)Thanks so much for your help =)) Interesting tho the register_globals is set to off in my godaddy server configuration, but it is php version 5.2.5, not the 5.3 that I have on my local host. The sessions work flowlessly on the local host with php5.3, but they don’t work at all on the web- the sessions start, but die with page refresh, so even a simple counter wouldn’t work.
The override_function made my blog die by a horrible deph, but I am researching into the metter now- simse that wordpress does have similar things that let you override they core functions- remove_action and remove_filter functions. I will let you know if I find a solution. Thanks very much again for taking your time to help =))
I’ve commented out the call to wp_unregister_GLOBALS()- in the online version it didn’t have a body to it in wp-settings, just a call for it. And guess what- nothing happend as I suspekted, since register_globals were off in both of my server configurations. I register sessions function in functions.php, have add_action(‚init‘, ‚f_name‘) and do a session start inside the body. On my local server it worked anyway I did it- even with session start in the top of the header… But as soon as I upload code online- sessions die horribly. I think I am at give up stage, I’ve searched alto for a week, tryed everething. Time to move on and try and achieve the same with cookies, just set it to not display anything if the cookies are off. And do some checks perhaps to see if the cookie code has been modified….
That sounds really strange. Have you tried to put
session_start()into to a very early-loading file? For example, I like to put it at the very bottom of mywp-config.php, and I’ve never had any problems with that.I’m in the same boat as Max who commented on 25 July 2010. I have session_start() at the top of wp_config. I tried the php.ini in the same directory as wp_settings. I then did surgery on the wp_unregister_globals function in wp_settings with some //’s and it seemed to work for a while, but then returned to some strange behavior once again.
For example, my $_SESSION[‚test‘] was unset in php script unrelated to WordPress, but the pages on WordPress still register the value of $_SESSION[‚test‘]–and even seem to insert some values of its own. All other non-Wordpress scripts show nothing for the variable during all this.
If I figure out a solution for this I’ll leave another comment heh.
I Love you man.