Reputation: 4673
I cannot tell if this is a bug in PHP 7.0 and 7.1 or a configuration error that is fixable. I have an application that has used cookie-less sessions in PHP for years very successfully. But things keep breaking in PHP 7.0 and PHP 7.1. Here is the PHP script:
<?php
ini_set('session.use_cookies', '0');
ini_set('session.use_only_cookies',0);
ini_set('session.use_trans_sid',1);
session_start();
?>
<p><a href="index.php">Click This Anchor Tag!</a></p>
<p><a href="#place">Internal link</a></p>
<p>Our Session ID is: <?= session_id() ?></p>
<p>Our PHP Version is: <?= phpversion() ?></p>
In PHP 5.6.28 and all earlier versions as well as PHP 7.0.x, the configuration option url_rewriter.tags
decides which tags get the session appended automatically. The default for this is:
url_rewriter.tags="a=href,area=href,frame=src,input=src,form=,fieldset="
http://php.net/manual/en/outcontrol.configuration.php#ini.url-rewriter.tags
With this as default, the correct output of the above script in PHP 5.6.28 is:
<p><a href="index.php?PHPSESSID=aec2a7538bfe295d6a6c9ff70c42f8eb">Click This Anchor Tag!</a></p>
<p><a href="#place">Internal link</a></p>
<p>Our Session ID is: aec2a7538bfe295d6a6c9ff70c42f8eb</p>
<p>Our PHP Version is: 5.6.28</p>
But now we move to PHP 7.0.13 - it is configured the same way as PHP 5 so it has:
url_rewriter.tags="a=href,area=href,frame=src,input=src,form=,fieldset="
But the output of the above script in PHP 7.0.13 is:
<p><a href="index.php">Click This Anchor Tag!</a></p>
<p><a href="#place">Internal link</a></p>
<p>Our Session ID is: a336e933e677c001ae8faf20b7158fb4</p>
<p>Our PHP Version is: 7.0.13</p>
Nothing is rewritten.
In PHP 7.1, there is a new configuration variable called session.trans_sid_tags
which accomplishes the same thing. In my PHP 7.1.0 instance I have:
session.trans_sid_tags="a=href,area=href,frame=src,form=" (default)
This is not in the php.ini
file but looking at PHPInfo the default is what we get.
http://php.net/manual/en/session.configuration.php#ini.session.trans-sid-tags
In PHP 7.1 it is almost working:
<p><a href="index.php?PHPSESSID=a17309afea8f2791078fc046cce5fa56">Click This Anchor Tag!</a></p>
<p><a href="#place/?PHPSESSID=a17309afea8f2791078fc046cce5fa56">Internal link</a></p>
<p>Our Session ID is: a17309afea8f2791078fc046cce5fa56</p>
<p>Our PHP Version is: 7.1.0</p>
It is mistakenly rewriting the named anchor #place
. Everything else is working.
Help - I am wondering if there is just a configuration option in PHP 7.1.0 that is missing or is this just a bug in PHP 7 that is not yet working.
Upvotes: 5
Views: 740