Re: cvs: phpdoc /en/reference/array/functions extract.xml [snip]
| From: | rschwartz@ec.rr.com | Date: | Tue, 30 Mar 2004 09:50:38 +0000 |
| Subject: | Re: cvs: phpdoc /en/reference/array/functions extract.xml [snip] | ||
| References: | 1 2 | Groups: | php.doc |
| Request: | Send a blank email to phpdoc+get-969359837@lists.php.net to get a copy of this message | ||
Sure.
> On Tue, Mar 09, 2004 at 10:38:14AM -0000, Kenneth Schwartz wrote:
> > irchtml Tue Mar 9 05:38:14 2004 EDT
> >
> > Modified files:
> > /phpdoc/en/reference/array/functions extract.xml
> [snip]
> > Log:
> > extract: minor revision
> > others: use <void/>
> > + user-input ($_GET, ...). If you do, for example, if you want to run old
> > + code that relies on
> > <link
> > linkend="security.registerglobals">register_globals</link>
> > temporarily, make sure you use one of the non-overwriting
> > - <parameter>extract_type</parameter> values like EXTR_SKIP, and be aware
> >
> > - that you should now extract <varname>$_SERVER</varname>,
> > - <varname>$_SESSION</varname>, <varname>$_COOKIE</varname>,
> > - <varname>$_POST</varname> and <varname>$_GET</varname> in
> > that order.
> > + <parameter>extract_type</parameter> values like
> > <constant>EXTR_SKIP</constant>
> > + and be aware that you should extract <varname>$_GET</varname>,
> > + <varname>$_POST</varname>, <varname>$_COOKIE</varname>,
> > + <varname>$_SESSION</varname> and
> > <varname>$_SERVER</varname> in that order
> > + when using an overwriting <parameter>extract_type</parameter> or in
> > + reverse order when using a non-overwriting type.
>
> Could you please revert that? It advises users to create security holes.
> As it is stated before, NEVER use an overwriting type on user-input,
> since then anything ($_SERVER, $_SESSION, ...) can easily be
> compromised.