PHP __PHP_Incomplete_Class Object with my $_SESSION data

by

When you’re accessing $_SESSION, you’re not just changing the current script’s copy of the data read from the session, you’re writing SafeString objects back into the active session.

But putting custom objects in the session is dodgy and something I would generally try to avoid. To be able to do it you have to have defined the class in question before calling session_start; if you don’t, PHP’s session handler won’t know how to deserialise the instances of that class, and you’ll end up with the __PHP_Incomplete_Class Object.

So avoid frobbing the session. If you must take this approach, make a copy of the data from $_SESSION into a local $mysession array. However, I have to say I think the whole idea of a SafeString is dangerous and unworkable; I don’t think this approach is ever going to be watertight. Whether a string of raw text is ‘safe’ is nothing to do with where it came from, it is a property of how you encode it for the target context.

If you get another text string from a different source such as the database, or a file, or calculated within the script itself, it needs exactly the same handling as a string that came from the user: it needs to be htmlspecialchars​ed. You’re going to have to write that escape anyway; the safestring gains you nothing. If you need to send the string to a different destination format, you would need a different escape.

You cannot encapsulate all string processing problems into one handy box and never think about them again; that’s just not how strings work.

More Related Contents:

  1. How can I access an array/object?
  2. PHP Fatal error: Using $this when not in object context
  3. PHP: Storing ‘objects’ inside the $_SESSION
  4. PHP OOP core framework
  5. PHP check whether property exists in object or class
  6. PHP session lost after redirect
  7. Use global variables in a class
  8. Keeping session alive with Curl and PHP
  9. How to initialize static variables
  10. cleanup php session files
  11. Trying to get property of non-object – Laravel 5
  12. mysqli_query() expects parameter 1 to be mysqli, object given
  13. Session lost when switching from HTTP to HTTPS in PHP
  14. When to use static vs instantiated classes
  15. PHP Accessing Parent Class Variable
  16. Can you create instance properties dynamically in PHP?
  17. PHP Sessions with disabled cookies, does it work?
  18. Remotely destroy a session in php (user logs in somewhere else)?
  19. Return PHP object by index number (not name)
  20. What’s difference between __construct and function with same name as class has? [duplicate]
  21. Why Session object destruction failed
  22. Object of class stdClass could not be converted to string
  23. Get all defined classes of a parent class in php
  24. stdClass object and foreach loops
  25. My Laravel 5.2.10 Sessions wont persist
  26. Calling a function within a Class method?
  27. Laravel / Intervention Image Class – class not found
  28. laravel – Can’t get session in controller constructor
  29. How do I save PHP session data to a database instead of in the file system?
  30. How to decode a JSON String with several objects in PHP?

Leave a Comment