custom php.ini file in subfolder causing issues with $_SESSIONS variables

I have a sub-folder with two files. The first is email.php, with a form that user can send me an email. It also has a captcha-like script to prevent spam, and uses $_SESSION[foo] variables. The second is upload.php, which allows registered users to upload files. Both files worked fine. Now I need to increase the upload_max_filesize from the base 2MB for upload.php. My host does not provide access to main php.ini, but recommend that I create a custom php.ini file in this subfolder. So I created:

php.ini

upload_max_filesize = 10M ;
post_max_size = 10M ;

I now get the errors Warning: include() [function.include]: Filename cannot be empty and Warning: include() [function.include]: Failed opening '' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') when I submit the form/captcha on email.php.

$_SESSION[foo]=$_GET[bar]; 
else  $_SESSION[foo]="foobar.php";
include($_SESSION['foo']); 

I found that $_SESSION[foo] is empty even with the else. After some research I found that when I ran phpinfo() that session.save_path was no value (the orig开发者_开发问答inal was /tmp). So now

php.ini

upload_max_filesize = 10M ;
post_max_size = 10M ;
session.save_path = /home/foobar/tmp ;

But I am still getting the error. If I remove the php.ini file from this folder, then the form script on email.php works just fine, but I am back to upload_max_filesize = 2MB for upload.php. Any help would be appreciated.

---

This is an issue with CGI PHP setups where the server php.ini directives do not cascade into custom configurations.

I've written about this extensively here - http://blog.philipbrown.id.au/2009/08/php-suexec-and-custom-php-ini-files/

---

$_SESSION[foo]=$_GET[bar]; else $_SESSION[foo]="foobar.php"; include($_SESSION['foo']);

I'm a bit confused by this snippet. Not only is it invalid (no if statement, array indexes not quoted) but highly insecure.