Re: Re: Lost feature - variables_order/register_globals mess

Rasmus Lerdorf wrote:

Well, you still need to resolve precedence for $_REQUEST somehow.

I forgot about $_REQUEST :) How about this one? - Store EGPCS to $_* hash and initialize them always.

That can get expensive since 'E' can be rather large and is usually full of useless stuff. Perhaps always populating GPCS is a good choice here. 'E' can always be fetched individually via getenv() anyway. Since there no equivalent getpost() function it is a good idea to not toss this data.

Sounds good. Environment vars are mostly useless. I thought it would be a little easier to implement this change if environment vars were in hash just like others.

- Create "global_order" ini entry to determine $GLOBAL precedence. - Create "request_order" ini to entry determine $_REQUEST precedence. - Get rid of "variable_order" and "gpc_order". If user uses them, warn about it(?).

Why not just leave variables_order alone and not affect BC. If GPCS is always populated then this issue is solved. With register_globals on and variables_order set to "S" you would still get server vars in the global symbol table, be able to use import_request_variables() to import request vars into the global symbol table (and probably rename them along the way) and access $_GET, $_POST, etc... directly.

I thought "global_order" & "request_order" is more intuitive name. and it's clear to users it behaves a little differenly before. It may not worth it.

This change is acceptable for 4.2.0, IMHO. (Many lines are needed to be changed, but we are going to set "register_global=Off" as a default, right?)

Correct. Which is why I am looking at real-world uses here. Despite the shorter symbol names, it is still a hassle writing echo $_GET['var'] all the time. And there is no decent reason not to import Server variables into the global namespace. To me a good setup would be: register_globals = On variables_order = "S" always_populate_gpcs (not a directive) <?php

    import_request_variables('GP', 'r_');
    echo $HTTP_USER_AGENT;
    echo $r_var;

?> To me that script is cleaner and nicer than: <?php

    echo $_SERVER['HTTP_USER_AGENT'];
    echo $_REQUEST['var'];

?>

Personally, I prefer "register_globals=Off" for session, but no objection here also. If we always initialize $GLOBALS specified by "variables_order", we may get rid of "register_globals". If there is no "register_globals", session module can be simplified a lot and we can forget about bugs related to it. (I'm not serious about this. Just my wish ;) -- Yasuo Ohgaki _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com