{"id":155,"date":"2008-08-15T15:08:21","date_gmt":"2008-08-15T13:08:21","guid":{"rendered":"http:\/\/blog.ginchen.de\/?p=155"},"modified":"2008-12-20T05:29:21","modified_gmt":"2008-12-20T04:29:21","slug":"session-variablen-in-wordpress","status":"publish","type":"post","link":"http:\/\/blog.ginchen.de\/en\/2008\/08\/15\/session-variablen-in-wordpress\/","title":{"rendered":"Session variables in WordPress"},"content":{"rendered":"<p>For three days I had nearly despaired when I tried to extend a WordPress site with a self-written login script. Everything worked properly on my local server, but as soon as I had uploaded it, the session variables didn&#8217;t seem to be passed any more: after the login, I stayed logged in for only one more click and then got logged out again.<\/p>\r\n\r\n\r\n<!--more-->\r\n\r\n\r\n\r\n\r\n<p>After several unsuccessful Google searches (with the wisdom of hindsight it&#8217;s quite easy to google, but try and find something about this issue without reading any further than this) I found the reason at last, namely the function <code>wp_unregister_GLOBALS()<\/code> inside the file <code>wp-settings.php<\/code>. Here it is:<\/p>\r\n\r\n<pre lang=\"php\" line=\"26\">\r\nfunction wp_unregister_GLOBALS() {\r\n    if ( !ini_get('register_globals') )\r\n        return;\r\n\r\n    if ( isset($_REQUEST['GLOBALS']) )\r\n        die('GLOBALS overwrite attempt detected');\r\n\r\n    \/\/ Variables that shouldn't be unset\r\n    $noUnset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES', 'table_prefix');\r\n\r\n    $input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());\r\n        foreach ( $input as $k => $v )\r\n            if ( !in_array($k, $noUnset) && isset($GLOBALS[$k]) ) {\r\n                $GLOBALS[$k] = NULL;\r\n                unset($GLOBALS[$k]);\r\n            }\r\n}\r\n<\/pre>\r\n\r\n<h3>What does this function do?<\/h3>\r\n\r\n<ul>\r\n\t<li><em>Line 27\/28:<\/em><br \/>\r\nIf <code>register_globals<\/code> is not activated in the PHP settings of the web server, it won&#8217;t do anything at all (which explains the different behaviours of my script on my local and the live server). If, however, <code>register_globals<\/code> is active, it proceeds as follows:\r\n\t\t<ul>\r\n\t\t\t<li><em>Line 34:<\/em><br \/>\r\nAs the comment already says, all global variables listed here will <em>not<\/em> be reset. As you can see, <code>$_SESSION<\/code> is <em>not<\/em> being mentioned!<\/li>\r\n\t\t\t<li><em>Line 36-41:<\/em><br \/>\r\nNow, all global variables are being shifted and deleted one by one.<\/li>\r\n\t\t<\/ul>\r\n\t<\/li>\r\n<\/ul>\r\n\r\n<p>In short: If <code>register_globals<\/code> is activated, <code>$_SESSION<\/code> will be deleted on <em>every single<\/em> page view. No surprise that we can&#8217;t get at our session variables any more!<\/p>\r\n\r\n<h3>What&#8217;s it all about?<\/h3>\r\n\r\n<p>Well, for one thing, WordPress assumes that it&#8217;s meant to take care of the complete site &#8211; after all it is some kind of content management system. And that includes the administration of all variables as well.<\/p>\r\n\r\n<p>What&#8217;s much more important though, is the fact, that the use of <code>register_globals<\/code> has been deprecated for a long time and the feature will even be completely removed in PHP&nbsp;6. Today, it is strongly recommended not to use these kind of variables, because they involve safety hazards. So, WordPress is obviously trying to imitate the behaviour of a deactivated <code>register_globals<\/code> in order to ensure safety and avoid potential variable conflicts.<\/p>\r\n\r\n<h3>Remedy<\/h3>\r\n\r\n<p>After having solved this riddle, the solution was perfectly obvious: I have to deactivate <code>register_globals<\/code> on the web server, so WordPress wouldn&#8217;t even need to execute that stupid function. For this purpose, simply place a text file called <code>php.ini<\/code> inside your WordPress directory, containing the following line:<\/p>\r\n\r\n<pre lang=\"php\">register_globals Off<\/pre>\r\n\r\n<p>Further information on the subject can be found on <a  rel=\"external\" href=\"http:\/\/www.php.net\/\">php.net<\/a>:<\/p>\r\n<ul>\r\n\t<li><a  rel=\"external\" href=\"http:\/\/www.php.net\/manual\/en\/faq.using.php#faq.register-globals\">How does the PHP directive register_globals affect me?<\/a><\/li>\r\n\t<li><a  rel=\"external\" href=\"http:\/\/www.php.net\/manual\/en\/security.globals.php\">Using Register Globals<\/a><\/li>\r\n\t<li><a  rel=\"external\" href=\"http:\/\/www.php.net\/manual\/en\/language.variables.superglobals.php\">Superglobals<\/a><\/li>\r\n<\/ul>","protected":false},"excerpt":{"rendered":"For three days I had nearly despaired when I tried to extend a WordPress site with a self-written login script. Everything worked properly on my local server, but as soon as I had uploaded it, the session variables didn&#8217;t seem to be passed any more: after the login, I stayed logged in for only one [&hellip;]","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[77],"tags":[107,109,106,606,105,108],"_links":{"self":[{"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/posts\/155"}],"collection":[{"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/comments?post=155"}],"version-history":[{"count":47,"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/posts\/155\/revisions"}],"predecessor-version":[{"id":840,"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/posts\/155\/revisions\/840"}],"wp:attachment":[{"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/media?parent=155"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/categories?post=155"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.ginchen.de\/en\/wp-json\/wp\/v2\/tags?post=155"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}