{"record":{"id":"34d29d7e44ecc9d6","repo":"phalcon/cphalcon","slug":"the-name-contains-non-alphanum-characters","errorCode":null,"errorMessage":"The name contains non alphanum characters","messagePattern":"The name contains non alphanum characters","errorType":"exception","errorClass":"Phalcon\\Session\\Exceptions\\InvalidSessionName","httpStatus":null,"severity":"error","filePath":"phalcon/Session/Manager.zep","lineNumber":307,"sourceCode":"     * and do not allow poop names\n     *\n     * @param string $name\n     *\n     * @return ManagerInterface\n     * @throws InvalidSessionName\n     * @throws SessionModificationDenied\n     */\n    public function setName(string name) -> <ManagerInterface>\n    {\n        if unlikely true === this->exists() {\n            throw new SessionModificationDenied();\n        }\n\n        if unlikely (\n            !preg_match(\"/^[\\p{L}\\p{N}_-]+$/u\", name) ||\n            preg_match(\"/^[0-9]+$/\", name)\n        ) {\n            throw new InvalidSessionName();\n        }\n\n        let this->name = name;\n\n        session_name(name);\n\n        return this;\n    }\n\n    /**\n     * Sets session's options\n     *\n     * @phpstan-param session_options $options\n     */\n    public function setOptions(array options) -> void\n    {\n        let this->uniqueId = this->getArrVal(options, \"uniqueId\", \"\"),\n            this->options  = options;","sourceCodeStart":289,"sourceCodeEnd":325,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Session/Manager.zep#L289-L325","documentation":"Manager::setName() accepts only names matching /^[\\p{L}\\p{N}_-]+$/u (unicode letters, digits, underscore, hyphen) and rejects names that are purely numeric; anything else (dots, spaces, symbols, empty string, '123') throws InvalidSessionName.","triggerScenarios":"Names like 'MY.SESSION' (dot), 'session id' (space), 'APP-SESSID!' (symbol), '' (empty), or '123' (all digits); names assembled from environment or host strings containing dots, e.g. 'app.example.com'.","commonSituations":"Using the domain as the cookie-name prefix; numeric names generated from a tenant/shop id; forgetting to set a name so an empty default string from config reaches setName(); names copied from other frameworks that allow dots.","solutions":["Use only letters, digits, underscore and hyphen, e.g. 'APPSESSID' or 'myapp_session'","Sanitize config-driven names: $name = preg_replace('/[^\\p{L}\\p{N}_-]/u', '', $name); then ensure it is non-empty and not all digits","Default the name in config so an unset value never reaches setName()"],"exampleFix":"// before\n$session->setName('myapp.example.com'); // dot -> InvalidSessionName\n\n// after\n$session->setName('myapp_session');","handlingStrategy":"validation","validationCode":"function sanitizeSessionName(string $name): string\n{\n    $name = preg_replace('/[^\\p{L}\\p{N}_-]/u', '', $name);\n    if ($name === '' || preg_match('/^[0-9]+$/', $name)) {\n        $name = 'APPSESSID';\n    }\n    return $name;\n}\n$session->setName(sanitizeSessionName($config->get('session.name')));","typeGuard":"function isValidPhalconSessionName(string $name): bool\n{\n    return (bool) preg_match('/^\\p{L}[\\p{L}\\p{N}_-]*$/u', $name)\n        && !preg_match('/^[0-9]+$/', $name);\n}","tryCatchPattern":null,"preventionTips":["Default the name in config so empty strings never reach setName()","Never derive the cookie name from a domain (dots) or a numeric id","Add a config assertion test that the session name matches the allowed alphabet"],"tags":["php","phalcon","session","cookies","validation"],"backgroundTag":"invalid-session-name","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}