Session variable in PHP containing object is changed when original object is changed [duplicate]

Question

In some third party code, that I am not allowed to change, something peculiar is happening.

They write a variable (an array containing objects) to the session (without serialising it) and then iterate using a foreach on the original variable (without using references). Whenever they change a value, the corresponding value in the session is also changed. I was able to create a smaller example that has the same behaviour:

$test = array((object)array("categories" => "test"));

$_SESSION['woot'] = $test;

print_r($_SESSION['woot']);

foreach ($test as $a) {
    if (!is_array($a->categories)) $a->categories = array(); 
}

print_r($_SESSION['woot']);

This is the result:

Array
(
    [0] => stdClass Object
        (
            [categories] => test
        )

)
Array
(
    [0] => stdClass Object
        (
            [categories] => Array
                (
                )

        )

)

I already noticed that, when I serialize and unserialize the object array, the problem does not occur.

Does anyone have an idea about what's happening here? Is it the code? Is it an incorrect server setting? I'd like to know a little more before I contact the devs of the code.

Additional information:

I am using PHP Version 5.3.14
Register globals is switched off

Regards, Joost.

deceze · Accepted Answer · 2014-02-19 14:14:26Z

3

A variable holding an object only holds a reference to that object. Assigning an object (an object reference) from one variable to another does not make a copy of the object, there's still only one object. If you modify that object, all variables holding a reference to that object will see the change, because there's only one object instance.

If you want to make a copy of an object, you need to explicitly clone it.

answered Feb 19, 2014 at 14:14

deceze♦

525k89 gold badges806 silver badges954 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Michal Brašna · Accepted Answer · 2014-02-19 14:23:42Z

1

In PHP objects are passed by reference and PHP uses copy-on-write.

$test = array((object)array("categories" => "test"));
// it is still the same array
$_SESSION['woot'] = $test;
foreach ($test as $a) {
    // You change something in an object, which is passed by reference
    if (!is_array($a->categories)) $a->categories = array();
}

Serialization and deserialization creates new objects

$test = array((object)array("categories" => "test"));
// new array with new objects
$test = unserialize(serialize($test));

edited Feb 19, 2014 at 14:23

answered Feb 19, 2014 at 14:14

Michal Brašna

2,33315 silver badges17 bronze badges

4 Comments

jberculo Over a year ago

I always thought a foreach only used references when you specificly said it should by adding an &. foreach($a => &$b) Learned something again.

Michal Brašna Over a year ago

@jberculo It is true for all variable types except for objects, where &$a is default behavior and is same as $a.

jberculo Over a year ago

There is one thing, however. The third party claims that they can't reproduce this problem with the same codebase. Is there a PHP version component at work as well?

Michal Brašna Over a year ago

@jberculo This behavior is core concept of PHP. On the other hand as you said you provided small example, there may be other things in play.

Collectives™ on Stack Overflow

Session variable in PHP containing object is changed when original object is changed [duplicate]

2 Answers 2

Comments

4 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

4 Comments

Linked

Related