Re: extract($_POST)
| From: | Marek Kilimajer | Date: | Wed, 23 Oct 2002 10:03:42 +0000 |
| Subject: | Re: extract($_POST) | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-121051@lists.php.net to get a copy of this message | ||
Well, it is about the same in terms of security.
Jason Wong wrote:
On Wednesday 23 October 2002 16:48, Marek Kilimajer wrote:If you do extract($_POST) (or import_request_variables('GPC')), you do exactly same thing as php would do if you have register_global=onBut if you're only doing extract($_POST) and not doing extract($_GET) etc as well, then you know all your variables have come from $_POST. Which is not the case if you have "register_globals = on" or use import_request_variables('GPC'), because you don't know where the variables came from.