blocks|key|2695363|text|会话id的确切特征取决于您使用的会话处理程序。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2695364|在生产环境中，您可能有不同的会话处理程序(例如，添加加密的会话处理程序，或者将会话infor存储在不同的位置，需要不同的密钥)。而且，最大长度并不是说每个id都应该是这个长度，所以即使使用相同的会话处理程序，不同的id也可能是有效的。|2695365|据我所知，无法“询问”会话处理程序id是否有效或它支持什么特性，因此我个人不会验证id，但只要尝试加载会话并在消息失败时捕获消息，在此之后，您可以在没有会话的情况下继续工作，或者优雅地关闭请求。|2695366|如果您仍然认为自己检查会话id是个好主意，那么您可以看看这个问题，在那里人们试图通过应用正则表达式来解决问题。|2695367|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/class.sessionhandler.php|1|https://stackoverflow.com/questions/3185779/the-session-id-is-too-long-or-contains-illegal-characters-valid-characters-are^0|G|6|0|0|0|0|S|4|1|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|D|3|E|5|6|7|X|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|Y|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|Z|8|@]|9|@$A|10|B|11|1|12]]|C|$]]|$1|J|3|-4|5|6|7|13|8|@]|9|@]|C|$]]]|K|$L|$5|M|N|O|C|$P|Q]]|R|$5|M|N|O|C|$P|S]]]]

The exact characteristics of a session id depend on the <a href="http://php.net/manual/en/class.sessionhandler.php" rel="nofollow noreferrer">session handler</a> you use.

On your production environment you might have a different session handler (for instance, one that adds encryption, or stores the session infor in a different place, requiring different keys). Also, the max length doesn't say that every id should be that exact length, so even with the same session handler, the different ids could be valid. 

To my knowledge, there is no way to 'ask' a session handler whether the id is valid or what characteristics it supports, so personally I wouldn't verify the id, but just try to load the session and catch the message if it fails, after which you can either proceed without a session, or close the request gracefully.

If you still think it's a good idea to check the session id yourself, you might have a look at <a href="https://stackoverflow.com/questions/3185779/the-session-id-is-too-long-or-contains-illegal-characters-valid-characters-are">this question</a>, where people attempted to solve the problem by applying a regular expression.

blocks|key|1457946|text|正如我在评论中所说，最好不要做你最初想做的事情。相反，请尝试将警告转到。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1457947|您可以配置哪些错误或警告php打印和/或日志：PHP错误报告，PHP显示错误，PHP日志错误|offset|length|1457948|entityMap|0|LINK|mutability|MUTABLE|url|http://php.net/manual/en/function.error-reporting.php|1|https://stackoverflow.com/questions/1053424/how-do-i-get-php-errors-to-display|2|https://stackoverflow.com/questions/3531703/how-to-log-errors-and-warnings-into-a-file^0|0|N|7|0|V|7|1|13|7|2|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]|$D|W|E|X|1|Y]|$D|Z|E|10|1|11]]|A|$]]|$1|F|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]|N|$5|I|J|K|A|$L|O]]|P|$5|I|J|K|A|$L|Q]]]]

As said in my comments, it is probbably best not to do what you initially wanted to do. Instead, try turning the warning of. 

You can configure what errors or warnings php prints and/or logs: <a href="http://php.net/manual/en/function.error-reporting.php" rel="nofollow noreferrer">PHP Error reporting</a>, <a href="https://stackoverflow.com/questions/1053424/how-do-i-get-php-errors-to-display">PHP display errors</a>, <a href="https://stackoverflow.com/questions/3531703/how-to-log-errors-and-warnings-into-a-file">PHP Log errors</a>

blocks|key|2695435|text|我完全同意@Misch诊断，但我认为解决方案必须是其他的。在检测到无效的PHPSESSID之后，只需将脚本挂起()即可。当您受到攻击或安全测试(模拟攻击)时，不需要输出任何内容。顺序应该是：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2695436|check+a+valid+PHPSESSID+cookie
if+it+is+not+valid+{
++++set+a+valid+arbitrary+new+PHPSESSID+cookie++//+this+is+a+courtesy,+and+a+sign+that+you+manage+the+issue
++++die()
}
start+the+session|code-block|syntax|javascript|2695437|对于长度问题，如前所述，不同的处理程序可能存在不同的值，只需在有效会话上观察您的值并使用该长度即可。|2695438|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

I totaly agree with @Misch diagnose, but I think that the solution must be other. After you detect an invalid PHPSESSID, just die() the script. When you are under an attack or under security test (that emulates an attack) there is no need to output any content. The sequence should be:

<pre><code>check a valid PHPSESSID cookie
if it is not valid {
 set a valid arbitrary new PHPSESSID cookie // this is a courtesy, and a sign that you manage the issue
 die()
}
start the session
</code></pre>

For the length question, as was say, there are different values possibles for different handlers, just observe your values on valid sessions and use that length.

blocks|key|1457962|text|您可以在您的session.sid_length=...文件中指定php.ini。检查正在通过phpinfo();使用的ini文件。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1457963|完成更改后，不要忘记重新启动Apache并清除正在测试的站点上的cookie。|1457964|entityMap^0|6|M|1B|A|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

You can specify <code>session.sid_length=...</code> in your php.ini file. Check which ini file is being used through <code>phpinfo();</code>.

Once you make the change, don't forget to restart your Apache and clear cookies on the site that you're testing.

I'm trying to check the value of the PHPSESSID before <code>session_start()</code> is called. I don't like messages like these. <code>session_start(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in</code>

Illegal characters can be filtered by a simple regex <code>preg_replace("/[^a-zA-Z0-9]/", "", $input_lines);</code>

But how do I check the max length? On my local XAMPP installation, I get a 26 character PHPSESSID, but on the deployment server I'm getting a 32 characters PHPSESSID.

The <a href="http://php.net/manual/en/function.session-id.php" rel="nofollow">PHP manual</a> is only saying something about the allowed characters, but noting about the length.

<blockquote>
 Depending on the session handler, not all characters are allowed within the session id. For example, the file session handler only allows characters in the range a-z A-Z 0-9 , (comma) and - (minus)!
</blockquote>

EDIT
The big issue in this case is that this throws a warning, even with error_reporting disabled. The error also throws out the path of the file location. And that is unwanted!

PHPSESSID default length

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

在调用session_start()之前，我试图检查PHPSESSID的值。我不喜欢这样的留言。session_start(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 a...

问PHPSESSID默认长度
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问PHPSESSID默认长度EN