Warning when trying session_start(); PHP

Question

Does anyone know what this Warning might be?

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at *caminho*) in *caminho* on line 2

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at *caminho*) in *caminho* on line 2

The only thing found on this line 2 of the file is:

session_start();

Grateful from now on!

As requested by posting the file index php.:

<?php

session_start();

require("require/config.php");
require(REQUIRE_PATH . "db.php");
require(CLASS_PATH . "class.login.php");

if(isset($_GET["url"]) && !empty($_GET["url"])){

    $url = $_GET["url"];

    if(in_array($url, $config["secure_pages"])){

        $file = INCLUDE_PATH . $url . ".php";

        if(file_exists($file)){

            include($file);

        } else{

            include(INCLUDE_PATH . "home.php");

        }

    } else{

        include(INCLUDE_PATH . "home.php");

    }

} else{

    include(INCLUDE_PATH . "home.php");

}
}

Answer 1

The error "headers already sent" means that information has already been sent to the customer at the time the line is executed.

The session_start should be called at the beginning, before any HTML, since it changes HTTP headers.

In particular:

• There can be no text before the <? with the session_start;
• You can’t have any echo, print or anything else that prints text;
• You cannot have any call to the function flush
• If you include a file (require_once, etc.), so this file can’t print anything either;
  • This includes text after ?> ending the file. Not even blank lines, not spaces.
• The PHP files in question cannot have Byte Order Mark (BOM).

UTF-8 BOM is a 3 byte (optional) set at the beginning of the file indicating that a file is in UTF-8.

When the text editor sees BOM, it knows what to do: interpret the rest of the file as UTF-8 and hide BOM. When PHP interprets the file, it does not know what UTF-8 or BOM is. Instead, it reads the file as ISO-8859. These 3 bytes are therefore 3 characters to send to the browser. Like text before the <? is sent to the browser, GOOD is also because PHP does not notice the difference.

When the browser gets BOM, it knows it should ignore it and all browsers (IE, Firefox, Chrome, etc.) do it correctly. Hence the GOOD is not visible (not even in the "See source code of this page"). However, it is there and was sent.

In HTTP, the headers (headers) must be sent before the content of the page. So when PHP sends text to the client in some way, it has to send the headers first. Once the headers are sent, they cannot be changed to that page without reloading it. That is, when PHP sends BOM to the client, it sends the headers first.

The session_start changes headers. However, headers have already been sent to the client ("headers already sent"). Hence it does not work.

Removing BOM, PHP stops sending headers before it reaches session_start, and as such the function functions correctly.