Re: Security Issues

Zeev Suraski wrote: > Because it's a matter of taste, and different people see things different > ways. Personally I find $_GET["foo"] much clearer than $foo. It tells me, > beyond a reasonable doubt, where this thing is coming from. The one and > only drawback I see for this method is that it's a few more keystrokes, but > that's by far less important than what it gives you. As a matter of fact, > if I make $_GET and its friends be implicitly global, it'd actually safe > you keystrokes in many situations, and is definitely easier than teaching > users about the notion of the global scope, the global statement or $GLOBALS. > If I can just interject once, I was a bit skeptical of this thread at first but I'm starting to come around to Zeev's point of view. Security aside (which I know it shouldn't be) I found in my own coding I always started naming post or get variables like $form_user_name or $post_user_name so I could easily tell just by looking at individual sections of the code that this variable was web input, vs my own internal variable. But even still, it can be confusing to newbes trying to understand "just how did this variable get its value?". Having the $_GET[ "post_user_name"] is much more straight forward. But is there a $_POST call also? Making a important distinction between data posted or getted input? If so, that may be a small inconvienence. Good debate tho, and well timed for other issues I'm dealing with. Brian