diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index f79c1a63a0..c9592d9ed0 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -1062,7 +1062,7 @@ class baseRouter
 
         $this->sessionID = isset($ztSessionHandler) ? $ztSessionHandler->getSessionID() : session_id();
 
-        if(isset($_GET[$this->config->sessionVar]))
+        if(isset($_GET[$this->config->sessionVar]) and preg_match('/^\w+$/', $_GET[$this->config->sessionVar])) // Check zentaosid only exist [0-9a-zA-Z_].
         {
             helper::restartSession($_GET[$this->config->sessionVar]);
         }