phpdigSessionRemove() fix

[zas]

In 1.8.8 version, define('PHPDIG_SESSID_VAR','PHPSESSID,s,from');
do not cause "from=_test_" to be stripped from url, but only "from=", that's a bug.
It's because '_' is not part of characters matched by ereg_replace() in phpdigSessionRemoveIt() defined in file robot_functions.php.

$what is not escaped before being concatenated to regexp, this is another potential issue, especially if a variable name contains a dot.
define(''PHPDIG_SESSID_VAR','PHPSESSID,d.c') will cause "doc=xxx' to be stripped for url.

Matching & doesn't make sense to me (& should be escaped if found in value isn't it ?).

I modified phpdigSessionRemoveIt() like this:

function phpdigSessionRemoveIt($what,$eval) {
    $eval = preg_replace('/([?&])'.preg_quote(trim($what)).'=[^&]*/','$1',$eval);
    $eval = str_replace('&&','&',$eval); 
    $eval = eregi_replace('[?][&]','?',$eval); 
    $eval = eregi_replace('&$','',$eval);
    $eval = ereg_replace('[?]$','',$eval); // remove trailing question mark
    return $eval;
}

It works for me.