Re: Passing an Object

Andrei Zmievski wrote: > > If you create an object from what I pass you into your program and what > > you think is what you put there as a hidden value the page before, I'll > > own you faster than you can say "3l33t". > > That's beside the point. All he wanted to know was how to pass objects > through the form. Security concerns are a different matter. Security points are exactly the matter, because passing objects forward and backward through a trust boundary is exactly was makes millions of web applications vulnerable today. Why is the current state of web programming so bad? Because people do neglect security matters and because they are using bad programming models as a standard practice. Why are people do such stupid things? Because they are not taught better. Compare this for example to the works of W.Richard Stevens ("Advanced Programming in the UNIX Environment", "Unix Network Programming"). Stevens books are known for his complete and correct examples. Stevens not only spells out how things are done in Unix, but he also demonstrates in every single example how the things are done correctly, that is, with proper error handling and in a portable way. This is a much better way to answer "How do I ...?" questions, because it answers the "Why do I ...?" and "What does it cost to ...?" questions, too, which are implicitly behind each and every "How do I ...?" question. In this particular case, pointing to a session management package and explaining why you do not want your objects to be within your users browsers would have done much better. There are several ready-made texts available how to do this in PHP3. Kristian -- Kristian Köhntopp, NetUSE Kommunikationstechnologie GmbH Siemenswall, D-24107 Kiel, Germany, +49 431 386 436 00 Using PHP3? See our web development library at http://phplib.netuse.de/ (We have moved! Update your bookmarks!)