#21129 [NEW]: config setting for only superglobal arrays (no more $HTTP_*_VARS)

From: hugo@gewis.nl Operating system: any PHP version: 4.2.3 PHP Bug Type: Feature/Change Request Bug description: config setting for only superglobal arrays (no more $HTTP_*_VARS) IMHO it would be nice to have a configuration option that ensures that only $_POST, $_GET, $_SERVER, $_ENV etc. are set, and that $HTTP_POST_VARS, $HTTP_GET_VARS, $HTTP_SERVER_VARS, $HTTP_ENV_VARS etc. are not defined. Why? Obviously to remove the overhead of having a duplicate version of each variable. Furthermore, this can assist in cleaner, more secure code (in my humble opinion). For example:I just ran into a situation where a login was checked. The submitted password was removed from $_POST. It was, however, still available from $HTTP_POST_VARS. (Of course, this last issue could also be fixed by making one a reference to the other (as suggested in bug 15180).) I think the phrase 'avoid duplication of volatile information' applies here. Hugo -- Edit bug report at http://bugs.php.net/?id=21129&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=21129&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=21129&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=21129&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=21129&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=21129&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=21129&r=support Expected behavior: http://bugs.php.net/fix.php?id=21129&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=21129&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=21129&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=21129&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=21129&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=21129&r=dst IIS Stability: http://bugs.php.net/fix.php?id=21129&r=isapi