Unsetting session variables with auto appended files

[khaos337]

i have two files in my code that are loaded with auto_prepend_file and auto_append_file. I have found that unsetting session variables with either of these files that are autoloaded does not work correctly, but does work if i use the same code in a require() call from each individual page. obviously i'm trying to avoid having write the requires in each page, but I may not be able to avoid it if this doesn't work correctly. Here is an example, i have the following files: preload.php:

<?phpsession_start(); var_export($_SESSION['test']);unset($_SESSION['test');var_export($_SESSION['test']);?>

.htaccess:

php_value	   auto_prepend_file	  /dir_to_file/preload.php

example.php:

<?php$_SESSION['test'] = 'test';?>

now, if i call example.php twice theoretically the first var_export should print "test", and the second should print NULL, but they both print NULL. Now, if I move the 3 lines with the var_export and unset functions to another file called require.php and then rewrite example.php as follows:

<?phprequire_once('require.php');$_SESSION['test'] = 'test';?>

Then everything works perfectly as expected. So my question is, what is different about the auto_prepend_file and auto_append_file (it doesn't matter if i load the unset function in either one, it still acts the same) and the require() function, because accoring to php.net, they should function the same:

auto_prepend_file string Specifies the name of a file that is automatically parsed before the main file. The file is included as if it was called with the require() function, so include_pathis used. The special value none disables auto-prepending. auto_append_file string Specifies the name of a file that is automatically parsed after the main file. The file is included as if it was called with the require() function, so include_path is used. The special value none disables auto-appending.

Any ideas?

[boen_robot]

Seems like a bug in PHP... you may want to report it along with more details about your setup (that is, assuming you're using PHP 5.3.10 or 5.4.0RC7; If not, you should upgrade your PHP).

[khaos337]

im running 5.2.17. will definitely upgrade and post results. thanks for the reply.

[khaos337]

So I upgraded to 5.3.10. Same behavior if the session_start() call and unset() call are both in the prepended file, however now at least if the session_start() call is in the prepended file and the unset() call is in the appended file it works correctly. Another strange thing is that if the entire code is in the auto prepended file and the unset statement is wrapped in an if statement that is false, for instance if my URI is /test.php and my code is as follows:

echo $_SERVER['REQUEST_URI'];if($_SERVER['REQUEST_URI'] != '/test.php'){unset($_SESSION['test']);echo 'true';}var_export($_SESSION['test']);

it always echo's null on the var exports (meaning its calling the unset function), but NEVER echo's true....

[khaos337]

Also, it only works in the appended file if the session variable is a string, not an object, and unfortunately I need it to work on an object.

[boen_robot]

Again, report the bug to the PHP developers. Make sure you narrow down the problem though... it looks to me as if you're conflating several issues. Choose the one related to your problem. If you must, split the report into two bug reports.

[khaos337]

Yeah, I've definitely got to break it down because now that i upgraded code that worked previously isn't working so there may be something else going on as well. Will repost if I discover anything new. Thanks for the replies.

[justsomeguy]

It sounds like the session has not been started by the time the first file runs, since it works in the last file. It may be worth it to use print_r to check the contents of things like $_SERVER and $_SESSION in the prepend file.

[khaos337]

Ok, I figured out the issue. My OP might not have had all the pertinent information in it because at the time I thought that was what it boiled down to, and for that i apologize. The issues were 2 fold, the first was that I had the session_start() call before my class autoloader which was causing issues. The second issue was what was really causing the menacing problem which was the fact that my sessions were getting unset seemingly when the unset function was never called. Here is what happened. I had an if statement in my auto prepended file that checked the current page uri and unset the session if the uri's didn't match. Basically I only wanted this session variable to exist on a certain page, and if that page was navigated away from it destroyed it. The problem is even though PHP's manual says that auto_prepend_file and auto_append_file function exactly the same as require(), the do not. After really going nuts over this for 4 days I finally had an epiphany and put a call in my preload file to write every uri request to a database and here's what i found out. When each page is loaded the auto prepended file not only loaded the requested uri, but it loaded the uri '/favicon.ico/' twice, and the auto appended file loaded that uri once. So even when i was on the requested page, it saw a uri that wasn't requested and killed the session. This is also why 'true' never was output which was in the if statement to test, because it was the favicon triggering the if statement and not an actual page. Now i'm not sure if PHP is meant to function that way or if infact it is a bug, but at least now i know what was happening and can find out.

[boen_robot]

The favicon.ico thing is an IE... bug/semi-convention. That is, the browser itself sends two HTTP requests when visiting a domain for a first time.I assume you were clearing your cache after every failed attempt, so the favicon thing simply kept repeating as the browser was forgetting it had already visited the page.You should already whatever your rewrite rule is to make sure favicon.ico is not passed to PHP.