Doc #71686 [NEW]: parse_str() should have a warning about using it with untrusted data

From: aaronw at catalyst dot net dot nz Operating system: PHP version: 5.5.32 Package: Documentation problem Bug Type: Documentation Problem Bug description:parse_str() should have a warning about using it with untrusted data Description: ------------ The one-parameter version of parse_str() populates variables in the current scope, the same as register_globals or extract(). So like those, if it's used with user-supplied data then it is prone to bugs and security vulnerabilities where users can override global variables and other uninitialized variables. But unlike register_globals and extract(), there is no warning on the parse_str() manual page about using it with untrusted/user-supplied data. Quite the opposite, there's a note telling you how to use it with $_SERVER['QUERY_STRING']. So it would be better for new developers if there were a big pink "Warning" note on the page, much like the ones on the extract() page. It should advise users to instead use the two-parameter version, which extracts the values into an array instead of into variables. -- Edit bug report at https://bugs.php.net/bug.php?id=71686&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71686&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71686&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71686&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71686&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71686&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71686&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71686&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71686&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71686&r=support Expected behavior: https://bugs.php.net/fix.php?id=71686&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71686&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71686&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71686&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71686&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71686&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71686&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71686&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71686&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71686&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71686&r=mysqlcfg