Doc #71686 [Opn->Csd]: parse_str() should have a warning about using it with untrusted data

Edit report at https://bugs.php.net/bug.php?id=71686&edit=1 ID: 71686 Updated by: cmb@php.net Reported by: aaronw at catalyst dot net dot nz Summary: parse_str() should have a warning about using it with untrusted data -Status: Open +Status: Closed Type: Documentation Problem -Package: Documentation problem +Package: Strings related PHP Version: 5.5.32 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: > So it would be better for new developers if there were a big > pink "Warning" note on the page, […] Fixed with <http://svn.php.net/viewvc?view=revision&revision=341059>. > I would also love to have a way (in php.ini) to turn off the > ability for this function to write variables in the current > scope, […] There is currently a vote in progress to deprecate and to later remove parse_str() without second argument, see <https://wiki.php.net/rfc/deprecations_php_7_2#parse_str_without_second_argument>. Previous Comments: ------------------------------------------------------------------------ [2016-03-30 20:06:42] bshafs at gmail dot com This is a good start. I would also love to have a way (in php.ini) to turn off the ability for this function to write variables in the current scope, as this behavior makes the function insecure. ------------------------------------------------------------------------ [2016-02-29 01:41:13] aaronw at catalyst dot net dot nz Description: ------------ The one-parameter version of parse_str() populates variables in the current scope, the same as register_globals or extract(). So like those, if it's used with user-supplied data then it is prone to bugs and security vulnerabilities where users can override global variables and other uninitialized variables. But unlike register_globals and extract(), there is no warning on the parse_str() manual page about using it with untrusted/user-supplied data. Quite the opposite, there's a note telling you how to use it with $_SERVER['QUERY_STRING']. So it would be better for new developers if there were a big pink "Warning" note on the page, much like the ones on the extract() page. It should advise users to instead use the two-parameter version, which extracts the values into an array instead of into variables. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71686&edit=1