From: se@brainbits.net
Operating system: SuSE7.2; Apache 1.3.20; mod_php4
PHP version: 4.0.6
PHP Bug Type: Variables related
Bug description: HTTP_GET_VARS influenced by PHP_SELF
<?php
if($HTTP_GET_VARS["delete"]){
echo "delete";
}else{
echo "don't delete";
}
?>
<html>
<head>
</head>
<body>
<form action="<?php echo $PHP_SELF;?>" method="POST"
name="form1">
<input type="text" name="test">
<a href="javascript:document.form1.submit();">Save</a>
</form>
<a href="<?php echo $PHP_SELF;?>?delete=true">delete</a>
</body>
</html>
The script above don't work correctly. After clicking "delete" the
if-statement print "delete". Then you click on "Save" and the if-statement
print "delete" just like you click on "delete".
If the "echo $PHP_SELF" in the form-tag will be replaced by the
plaintext-name of the script everything will work correctly - you can click
on "Save" then and the if-statement gives you a "don't delete".
It seems like the $PHP_SELF stores the HTTP_GET_VARS, but if I do a "echo
$PHP_SELF" I get the script path, the script name and that's all, there are
no HTTP_GET_VARS - but the script still works like the HTTP_GET_VARS are
there.
--
Edit bug report at: http://bugs.php.net/?id=14288&edit=1