PHP 4.0 Bug #4205: Setting internal vars with form var names dangerous!
| From: | kai at jedi dot net | Date: | Thu, 20 Apr 2000 18:19:43 +0000 |
| Subject: | PHP 4.0 Bug #4205: Setting internal vars with form var names dangerous! | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-18069@lists.php.net to get a copy of this message | ||
From: kai@jedi.net
Operating system: Linux Red Hat 6.0
PHP version: 4.0 Release Candidate 1
PHP Bug Type: Feature/Change Request
Bug description: Setting internal vars with form var names dangerous!
Having the HTTP POST data set vars in the page willy-nilly is exteremly dangerous. You never know
how something got set, and anyone who has seen the source could find a way to pass in malicious
variables and values to your scripts. Yes, initting vars carefully helps but...
A feature that allows us to have FORM vars appear ONLY in the global HTTP_POST_VARS array (and not
set local variables as now) would be GREATLY appreciated.