php · Girgias · Aug 15, 2026 · Aug 15, 2026
@@ -158,3 +158,22 @@ PHP_METHOD(SessionHandler, create_sid)
 
 	RETURN_STR(id);
 }
+
+PHP_METHOD(SessionHandler, validateId)
+{
+	zend_string *id;
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &id) == FAILURE) {
+		RETURN_THROWS();
+	}
+
+	PS_SANITY_CHECK;
+	if (!PS(mod_user_is_open)) {
+		php_error_docref(NULL, E_WARNING, "Parent session handler is not open, ignoring ID validation");
+		RETURN_TRUE;
+	}
+
+	zend_result status = PS(default_mod)->s_validate_sid(&PS(mod_data), id);
+
+	RETURN_BOOL(status == SUCCESS);
+}
@@ -2158,6 +2158,9 @@ PHP_FUNCTION(session_set_save_handler)
 		} else if (zend_hash_find_ptr(object_methods, create_sid_name)) {
 			/* For BC reasons we accept methods even if the class does not implement the interface */
 			SESSION_SET_USER_HANDLER_OO(ps_create_sid, zend_string_copy(create_sid_name));
+		} else {
+			php_error_docref(NULL, E_DEPRECATED,
+				"Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated");
 		}
 		zend_string_release_ex(create_sid_name, false);
 
@@ -2179,6 +2182,9 @@ PHP_FUNCTION(session_set_save_handler)
 			if (zend_hash_find_ptr(object_methods, validate_sid_name)) {
 				/* For BC reasons we accept methods even if the class does not implement the interface */
 				SESSION_SET_USER_HANDLER_OO(ps_validate_sid, zend_string_copy(validate_sid_name));
+			} else {
+				php_error_docref(NULL, E_DEPRECATED,
+					"Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated");
 			}
 			if (zend_hash_find_ptr(object_methods, update_timestamp_name)) {
 				/* For BC reasons we accept methods even if the class does not implement the interface */
@@ -2929,6 +2935,20 @@ static PHP_GINIT_FUNCTION(ps)
 	ps_globals->random_seeded = false;
 }
 
+static int session_handler_interface_gets_implemented(zend_class_entry *self, zend_class_entry *class) {
+	if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("create_sid"))) {
+		zend_error(E_WARNING,
+			"Class %s implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0",
+			ZSTR_VAL(class->name));
+	}
+	if (!zend_hash_str_exists(&class->function_table, ZEND_STRL("validateid"))) {
+		zend_error(E_WARNING,
+			"Class %s implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0",
+			ZSTR_VAL(class->name));
+	}
+	return SUCCESS;
+}
+
 static PHP_MINIT_FUNCTION(session)
 {
 	zend_register_auto_global(zend_string_init_interned(ZEND_STRL("_SESSION"), true), false, NULL);
@@ -2947,6 +2967,7 @@ static PHP_MINIT_FUNCTION(session)
 
 	/* Register interfaces */
 	php_session_iface_entry = register_class_SessionHandlerInterface();
+	php_session_iface_entry->interface_gets_implemented = session_handler_interface_gets_implemented;
 
 	php_session_id_iface_entry = register_class_SessionIdInterface();
 

@@ -147,4 +147,7 @@ public function gc(int $max_lifetime): int|false {}
 
     /** @tentative-return-type */
     public function create_sid(): string {}
+
+    /** @tentative-return-type */
+    public function validateId(string $id): bool {}
 }
@@ -34,6 +34,15 @@ class TestSessionHandler implements SessionHandlerInterface
 		echo $data . PHP_EOL;
 		return true;
 	}
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 register_shutdown_function(function() {

@@ -18,6 +18,14 @@ class MySessionHandler implements SessionHandlerInterface {
     public function write($id, $session_data): bool { return false; }
     public function destroy($id): bool { return false; }
     public function gc($maxlifetime): int { return 1; }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 var_dump(session_module_name("files"));

@@ -24,6 +24,14 @@ class MySessionHandler implements SessionHandlerInterface {
     public function write($id, $session_data): bool { return true; }
     public function destroy($id): bool { return true; }
     public function gc($maxlifetime): int { return 1; }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 var_dump(session_module_name("files"));

@@ -44,6 +44,14 @@ class handler implements SessionHandlerInterface {
     }
 
     function gc($max_lifetime): int { return 1; }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 $hnd = new handler;

@@ -45,6 +45,14 @@ class handler implements SessionHandlerInterface {
     }
 
     function gc($max_lifetime): int { return 1; }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 $hnd = new handler;

@@ -49,6 +49,14 @@ class MySessionHandler implements SessionHandlerInterface {
         echo "gc: maxlifetime = {$maxlifetime}\n";
         return 1;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 session_set_save_handler(new MySessionHandler());

@@ -35,6 +35,14 @@ class MySessionHandler implements SessionHandlerInterface {
     function gc($maxlifetime): int {
         return 1;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 session_set_save_handler(new MySessionHandler());

@@ -37,6 +37,14 @@ class MySessionHandler implements SessionHandlerInterface {
     function gc($maxlifetime): int {
         return 1;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 session_set_save_handler(new MySessionHandler());
 session_start();

@@ -37,6 +37,14 @@ class MySessionHandler implements SessionHandlerInterface {
     function gc($maxlifetime): int {
         return true;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 session_set_save_handler(new MySessionHandler());

@@ -36,6 +36,14 @@ class MySessionHandler implements SessionHandlerInterface {
     function gc($maxlifetime): int {
         return 1;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 session_set_save_handler(new MySessionHandler());

@@ -35,6 +35,14 @@ class MySessionHandler implements SessionHandlerInterface {
     function gc ($maxlifetime): int {
         return 1;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 session_set_save_handler(new MySessionHandler());

@@ -38,6 +38,14 @@ class MySession implements SessionHandlerInterface {
         echo 'Garbage collect', "\n";
         return 1;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 $handler = new MySession;

@@ -25,6 +25,14 @@ class DummyHandler implements SessionHandlerInterface {
     public function gc($maxlifetime): int|false {
         return true;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 $initHandler = ini_get('session.save_handler');

@@ -5,6 +5,8 @@ session
 --FILE--
 <?php
 
+ob_start();
+
 class SessionHandlerTester implements \SessionHandlerInterface
 {
 
@@ -42,6 +44,13 @@ echo 'validateId() ', (method_exists($obj, 'validateId') ? ('returns ' . ($obj->
 var_dump($originalSessionId == $newSessionId);
 
 ?>
---EXPECT--
+--EXPECTF--
+Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0 in %s on line %d
+
+Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
+
+Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated in %s on line %d
+
+Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated in %s on line %d
 validateId() is commented out
 bool(true)
@@ -5,6 +5,8 @@ session
 --FILE--
 <?php
 
+ob_start();
+
 class SessionHandlerTester implements \SessionHandlerInterface
 {
 
@@ -38,6 +40,14 @@ echo "\n";
 
 ?>
 --EXPECTF--
+Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the create_sid() method which will be required in PHP 9.0 in %s on line %d
+
+Warning: Class SessionHandlerTester implementing SessionHandlerInterface is missing the validateId() method which will be required in PHP 9.0 in %s on line %d
+
+Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the create_sid() method defined is deprecated in %s on line %d
+
+Deprecated: session_set_save_handler(): Providing an object to argument #1 ($sessionhandler) which does not have the validateId() method defined is deprecated in %s on line %d
+
 validateId() is commented out
 
 Session ID:%s
@@ -31,6 +31,14 @@ class FailingDestroyHandler implements SessionHandlerInterface {
     function gc($maxlifetime): int|false {
         return 0;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 session_set_save_handler(new FailingDestroyHandler());

@@ -31,6 +31,14 @@ class FailingWriteHandler implements SessionHandlerInterface {
     function gc($maxlifetime): int|false {
         return 0;
     }
+
+    private int $id = 0;
+	public function create_sid(): string {
+	    return ++$this->id;
+	}
+	public function validateId(string $id): bool {
+	    return $id > 0 && $id <= $this->id;
+	}
 }
 
 session_set_save_handler(new FailingWriteHandler());