PHP 5.3 Session 變更：session_is_registered 棄用與統一遷移

PHP 5.3 Session 相關棄用清單

• session_register() — 註冊全域變數到 Session
• session_is_registered() — 檢查變數是否註冊
• session_unregister() — 取消註冊
• $HTTP_SESSION_VARS — 超全域陣列（改用 $_SESSION）

全部在 PHP 5.3 棄用、5.4 移除。

官方手冊範例（含註解）

<?php
// Use of session_register() is deprecated 不建議使用
$barney = "A big purple dinosaur.";
session_register("barney");

// Use of $_SESSION is preferred, as of PHP 4.1.0 首選 $_SESSION
$_SESSION["zim"] = "An invader from another planet.";

// The old way was to use $HTTP_SESSION_VARS
$HTTP_SESSION_VARS["spongebob"] = "He's got square pants.";

統一遷移策略

<?php
// 1. 入口檔案：啟動 session 並設定安全選項
session_start([
    'cookie_httponly' => true,
    'cookie_secure'   => isset($_SERVER['HTTPS']),
    'cookie_samesite' => 'Lax',
    'use_strict_mode' => true,
]);

// 2. 定義存取介面（建議封裝為類別）
class Session {
    public static function set(string $key, $value): void {
        $_SESSION[$key] = $value;
    }

    public static function get(string $key, $default = null) {
        return $_SESSION[$key] ?? $default;
    }

    public static function has(string $key): bool {
        return isset($_SESSION[$key]);
    }

    public static function remove(string $key): void {
        unset($_SESSION[$key]);
    }

    public static function clear(): void {
        $_SESSION = [];
    }

    public static function regenerate(): void {
        session_regenerate_id(true);
    }
}

// 3. 全專案統一使用 Session::set/get/has/remove
// 登入
Session::set('user_id', $user->id);
Session::set('user_name', $user->name);

// 判斷登入
if (Session::has('user_id')) { /* ... */ }

// 登出
Session::clear();
Session::regenerate();

批次替換腳本

<?php
// migrate_session.php
$files = new RecursiveIteratorIterator(
    new RecursiveDirectoryIterator(__DIR__)
);
$patterns = [
    '/session_register\s*\(\s*[\'"](\w+)[\'"]\s*\)/' => '$_SESSION[\'$1\'] = $1',
    '/session_is_registered\s*\(\s*[\'"](\w+)[\'"]\s*\)/' => 'isset($_SESSION[\'$1\'])',
    '/session_unregister\s*\(\s*[\'"](\w+)[\'"]\s*\)/' => 'unset($_SESSION[\'$1\'])',
    '/\$HTTP_SESSION_VARS/' => '$_SESSION',
];

foreach ($files as $file) {
    if ($file->isFile() && $file->getExtension() === 'php') {
        $content = file_get_contents($file->getPathname());
        $newContent = $content;
        foreach ($patterns as $pattern => $replacement) {
            $newContent = preg_replace($pattern, $replacement, $newContent);
        }
        if ($newContent !== $content) {
            file_put_contents($file->getPathname(), $newContent);
            echo "Updated: {$file->getPathname()}\n";
        }
    }
}

驗證遷移完整性

# 檢查是否仍有舊函式殘留
grep -rn "session_register\|session_is_registered\|session_unregister\|HTTP_SESSION_VARS" --include="*.php" .

# 檢查 session_start 是否在輸出前呼叫
grep -rn "session_start" --include="*.php" . | grep -v "^\s*//" | head -20

測試清單

1. 登入/登出流程正常
2. Session 資料跨請求保持
3. 並發請求無資料競爭
4. Session ID 重新生成運作
5. 超時自動清除
6. HTTPS 環境 Cookie Secure 正確