I've worked with PHP for a very long time, and yet this simple issue just shatters my world. It makes no sense to me whatsoever :/

<?php
session_start();
$_SESSION["user"] = "lalala";

echo $_SESSION["user"];
$user = 'new';
echo "<br>".$_SESSION["user"];
?>

Output:lalalal
new

I discovered this behavior of a normal variable affecting a SESSION variable of the same name as the source of a much larger problem, but simplified it down to those 5 lines.

How the hell is $user affecting the SESSION array? It makes absolutely no sense to me :/

register_globals are on. Turn them off. They should not be on anyway because they were depreciated and turned off by default in php4.2 in the year 2002 (about 7 years ago.)

What you are seeing is also the security hole that register_globals opened. A hacker can send your script post/get/cookie variables with the same name as your session variables and set your session variables to any value he wants.

register_globals are on. Turn them off. They should not be on anyway because they were depreciated and turned off by default in php4.2 in the year 2002 (about 7 years ago.)

What you are seeing is also the security hole that register_globals opened. A hacker can send your script post/get/cookie variables with the same name as your session variables and set your session variables to any value he wants.

Thank you very much. I was using a locally installed version of PHP, and I don't know why they were on, in all my years of working with PHP they've never been on :)