Re: PHP 4.0 Bug #2450: use session variable values after form method=post

henri.cujass@leolo.com wrote: > The problem is that the session_register is _stronger_ than the post method. > When I start a session and register a variable and give a value > to this variable, then the form post will not override the original value. This is how it ought to be. When you have a variable that comes from a session, it comes from a trusted source, your local disk. When a variabe comes from a GPC variable, it comes from an untrusted source, the Internet. An untrusted source must not be able to overwrite trusted values. The proper solution for your problem is to set up a mechanism like this: if (isset($post_value)) { $session_value = cleanup_value($post_value); } with $session_value being a session variable and $post_value being a GPC variable. The function cleanup_value() has be to provided by you and is exspected to sanity check the contents of $post_value, i.e. no unexspected characters, file paths or similar in it. Kristian -- Kristian Köhntopp, NetUSE Kommunikationstechnologie GmbH Siemenswall, D-24107 Kiel, Germany, +49 431 386 436 00 Using PHP3? See our web development library at http://phplib.netuse.de/ (We have moved! Update your bookmarks!)