Session constant SID changes its value

[jorgsowa]

Description

I'm not sure how to classify this problem, but the constant SID changes its value during the request. I understand the logic behind the changes, but that's just against the rules what constant is. It shouldn't change it's value.

Example:
https://3v4l.org/4s0Nm

$sid0 = defined('SID');
ini_set('session.use_cookies', 0);
ini_set('session.use_only_cookies', 0);
session_start();
$sid1 = SID;
session_destroy();
session_start();

$sid2 = SID;

var_dump($sid0);
var_dump($sid1);
var_dump($sid2);

PHP Version

All versions

Operating System

No response

[damianwadley]

What do you think should be done about it?

[jorgsowa]

Semantically it should be function returning the value for such purpose and we already have one, session_id. The same with first part of the content of SID, name is returned by session_name().

If this is inconsistency, then shouldn't this "constant" be deprecated/removed? What is other reason keeping it other than BC?

[kocsismate]

Accidentally, I also bumped into this WTF, so I added it to the PHP 8.4 deprecations RFC :)

[jorgsowa]

Thank you @kocsismate

[jorgsowa]

SID constant will be deprecated in 8.4 and removed in 9.0 https://wiki.php.net/rfc/deprecate-get-post-sessions