RE: [PHP-DEV] Should $foo and $HTTP_GET_VARS["foo"] be references to each other?

The various $HTTP_*_VARS[] are now protected against manipulation by users. So, for example, if you use $HTTP_SERVER_VARS["REMOTE_ADDR"], you're completely safe, and no-one from user-space can manipulate this (unless he spoofs his IP, but that's not what we're talking about here). This new protection feature is new in the latest CVS of PHP 4.0 (it's not implemented in PHP 4.0 Beta 4). Zeev At 01:04 27/02/2000 , James Moore wrote:

-----Original Message----- From: Zeev Suraski [mailto:zeev@zend.com] Sent: 26 February 2000 21:46 To: php-dev@lists.php.net Subject: [PHP-DEV] Should $foo and $HTTP_GET_VARS["foo"] be references to each other? What's the general consensus, if we can reach one... Should $foo and $HTTP_GET_VARS["foo"] be references to each other? In other words, if one changes $foo, should $HTTP_GET_VARS["foo"] also change automatically? Currently that's the way things are, but it's relatively new, and we can still decide. A while back on the php mailing list some one was writing a hacker proof(so called) log in routene one of the things that made me realise how easy it was to fake certian http vars was the ability to be able to chage them eg your remote_addr by appending what you wanted to the URL, should this be possible or should they be separate as well, one idea might be not to allow the change of the variables by PHP in some cases, maybe they should be set after the URL has been parsed. Any way, Just an Idea James -- James Moore http://www.prospect-enterprises.co.uk Zeev -- Zeev Suraski <zeev@zend.com> http://www.zend.com/ -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net

-- Zeev Suraski <zeev@zend.com> http://www.zend.com/