title: PHPSESSID default length
body: <p>I'm trying to check the value of the PHPSESSID before <code>session_start()</code> is called. I don't like messages like these. <code>session_start(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in</code></p>
  
  <p>Illegal characters can be filtered by a simple regex <code>preg_replace("/[^a-zA-Z0-9]/", "", $input_lines);</code></p>
  
  <p>But how do I check the max length? On my local XAMPP installation, I get a 26 character PHPSESSID, but on the deployment server I'm getting a 32 characters PHPSESSID.</p>
  
  <p>The <a href="http://php.net/manual/en/function.session-id.php" rel="nofollow">PHP manual</a> is only saying something about the allowed characters, but noting about the length.</p>
  
  <blockquote>
    <p>Depending on the session handler, not all characters are allowed within the session id. For example, the file session handler only allows characters in the range a-z A-Z 0-9 , (comma) and - (minus)!</p>
  </blockquote>
  
  <p><strong>EDIT</strong>
  The big issue in this case is that this throws a warning, even with error_reporting disabled. The error also throws out the path of the file location. And that is unwanted!</p>