php $ _SESSION var非常奇怪的问题

Question

Maybe I am too tired... but I can't figure out how the session id in this piece of code becomes 143 from 149.

echo "session id is".$_SESSION['userid'];
$smarty->assign('itemresults',$arr2);

$_SESSION['userid']

if (isset($_REQUEST['id']))
{
    $userid=$_REQUEST['id'];
}
else
{
echo "session id 1 is".$_SESSION['userid'];
    $userid=$_SESSION['userid'];
}
echo "session id 2 is".$_SESSION['userid'];

Output:

session id is149session id 2 value is143

UPDATE:

Ok just found out that If I change the var $userid the issue is no more but why assigning a value to $userid will modify $_SESSION['userid'] as well ??

The below code works:

if (isset($_REQUEST['id']))
{
    $userid2=$_REQUEST['id'];
}
else
{
echo "session id 1 value".$_SESSION['userid'];
    $userid2=$_SESSION['userid'];
}

Answer 1

you have register_globals turned on, which is a potential security hole (very easy to fall into as you've noticed), and a dead end (it's gone from 5.4).

http://www.php.net/manual/en/ini.core.php#ini.register-globals:

Whether or not to register the EGPCS (Environment, GET, POST, Cookie, Server) variables as global variables.

As of PHP 4.2.0, this directive defaults to off.

Please read the security chapter on Using register_globals for related information.

Warning

This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.