tedivm/Stash — pull request #135 by CMCDragonkai (2014-03-15 17:47:06+00:00)
Title: Switched include() to using eval + file_get_contents instead

This is a bit of a long story.

I've been working with tedivm/Stash for a while for an Authentication and Authorisation library. I was using the FileSystem driver for file based sessions. It was working for a long time, both from a Windows computer and on hosted Ubuntu system on Digital Ocean.

However I recently started testing it on my Ubuntu VM which runs on the same kind of specs as the Digital Ocean's VM in order to simulate a closer environment to production.

And then the session management broke.

I started logging everything to figure out what was happening. And what was happening was this, but let me describe the context first.

```
false]`;

I know this is the real file content prior the the include command because I wrote this as a part of my logger:

```
//...line 141
\FB::log(file_get_contents($path), 'FILE CONTENT PRIOR TO INCLUSION');

include($path);
//...etc
```

And it showed the above file content exactly prior to inclusion.

Now the next thing I did was log the `$data` variable.

```
//...line 141
\FB::log(file_get_contents($path), 'FILE CONTENT PRIOR TO INCLUSION');

include($path);

\FB::log($data, 'DATA VARIABLE');
//...etc
```

This is where the discrepancy appeared.

On my Windows (Apache + mod_php) system it showed:

```
"data" => [
"return" => [
"user_id" => false
],
"createdOn" => 1394901250
]
```

On my Ubuntu Digital Ocean VM it would show the same since the session management was working.

However on my Ubuntu VirualBox VM it would show:

```
"data" => [
"return" => [],
"createdOn" => 1394901250
]
```

Exactly the same createdOn timestamp, but an empty return array!?

Needless to say, this made session management impossible, since none of the sessions could ever be remembered.

Now the error goes away, and still works with all environments, if you instead use eval with file_get_contents:

```
eval('?>' . file_get_contents($path));
```

This technique is exactly equivalent to using include (the `?>` basically allows the file to start with `