Bug #8449 Updated: register_globals=on and track_vars=on produce strange results for arrays

ID: 8449 Updated by: rodif_bl@php.net Reported By: omakarenko@cyberplat.ru -Status: Critical +Status: Bogus Bug Type: Arrays related Operating System: linux PHP Version: 4.1.0RC1 New Comment: I looked into this... When you have register globals on it registers the $person as a global array when parsing the get request it adds [age] to the global $person array then when the post requet is parsed then it finds the global array and adds the [sname] to the same array. So this is what should happen. why are you using get and post requests... why don't you just use <input type=hidden name=person[blah] value=blah> Previous Comments: ------------------------------------------------------------------------ [2001-10-21 01:27:24] sniper@php.net Reproduced also with PHP 4.1.0RC1 Here is the complete script for all the lazy developers to try with: form.php: --------- <form action="form.php?person[age]=12" method=post> <input type=text size=32 name=person[sname] </form> <br> <?php echo "HTTP_POST_VARS<br>"; print_r($HTTP_POST_VARS); echo "<p>"; echo "HTTP_GET_VARS<br>"; print_r($HTTP_GET_VARS); echo "<p>"; echo "_POST<br>"; print_r($_POST); echo "<p>"; echo "_GET<br>"; print_r($_GET) ?> ------------------------------------------------------------------------ [2001-08-19 03:01:43] sniper@php.net Oops. I had register_globals=off in my php.ini. Then this works as expected. But when it is On, not. --Jani ------------------------------------------------------------------------ [2001-08-19 02:57:36] sniper@php.net This is fixed at least in PHP 4.0.6. Maybe even earlier. --Jani ------------------------------------------------------------------------ [2000-12-28 02:49:06] omakarenko@cyberplat.ru I was trying to make the example as short as possible so it looks stupid but it clearly demonstrates the problem. Two short examples o *correct* behaviour first: Example 1: <form action="bug.php?age=12" method=post> <input type=text size=32 name=sname> </form> the form sets age using url path and sname using post. I could use cookies for age but the example longer. The idea is to simultaniously use several different methods to pass the variables. Nothing unusual here. tarck_vars and register_globals are both on so in bug.php I have access to $HTTP_GET_VARS[age],$HTTP_POST_VARS[sname] and to $age, $sname. I have no $HTTP_GET_VARS[sname] and $HTTP_POST_VARS[age] and I should not to. So far so good. Example 2: let's try the following: <form action="bug.php?sname=Pupkin" method=post> <input type=text size=32 name=sname value='Collins'> </form> I use the same variable name in both requests. Now I have $HTTP_GET_VARS[sname] == 'Pupkin' and $HTTP_POST_VARS[sname]='Collins' and that is also correct and that is how can I check what method was used to pass the variable (the global $sname value depends on variables_order ofcourse) Example 3: the bug but let's put the variables into array: <form action="bug?person[age]=12" method=post> <input type=text size=32 name=person[sname] </form> Now I expect to have $person[age],$person[$sname] in my global space and $HTTP_POST_VARS[person][sname], $HTTP_GET_VARS[person][age]... right? The bug is that I also have both $HTTP_POST_VARS[person][age] and $HTTP_GET_VARS[person][sname] defined... Do you see the problem? person[age] has somehow propagated into $HTTP_POST_VARS while I had no person[age] in my post request... Now I have no way to find how was that variable passed to my script... If I have an person[id] defined in the cookie then I suddenly have also person[age] and person[sname] defined in HTTP_COOKIE_VARS and pesron[id] defined in both POST_VARS and GET_VARS! looks like a bug for me. Comments? oleg ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=8449&edit=1