session - session id 太长或包含非法字符，有效字符为 a-z、A-Z、0-9 和 '-,'

Question

如何解决:

Warning: session_start() [function.session-start]: The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in ..... on line 3

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at ......:3) in ..... on line 3

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at .....:3) in ..... on line 3

Answer 1

这是一个信息漏洞:恶意攻击者可能会更改 cookie 并为 PHPSESSID 分配非法字符以暴露此 PHP 警告，其中实际上包含文件路径和用户名等多汁信息!