Re: extract($_POST)

So what you are actually saying is that the switchover to register_globals turned off and using $_POST or $_GET retrieval is only as secure as older php methods where you could just pass the variable by name? If each process can only get the variables that were passed to it why would it matter which method you used? Ed On Wed, 23 Oct 2002, Marek Kilimajer wrote: > Well, it is about the same in terms of security. > > Jason Wong wrote: > > >On Wednesday 23 October 2002 16:48, Marek Kilimajer wrote: > > > > > >>If you do extract($_POST) (or import_request_variables('GPC')), you do > >>exactly same thing as php would do if you have > >>register_global=on > >> > >> > > > >But if you're only doing extract($_POST) and not doing extract($_GET) etc as > >well, then you know all your variables have come from $_POST. > > > >Which is not the case if you have "register_globals = on" or use > >import_request_variables('GPC'), because you don't know where the variables > >came from. > > > > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >