Re: extract($_POST)

Statements, such as "Well, it is about the same in terms of security." are simply too vague to be useful. Mr. Lerdorf's explanation provides the most definitive answer concerning this issue. He should know; he and others created/wrote PHP. If you use extract($_POST), then the values contained therein cannot be corrupted by a user calling the PHP script directly with values in the URL line. Whereas, if one were to rely on automatically registered variables, then values passed from a form could be overwritten via the URL line; a definite security breach. Therefore, given Rasmus' explanation, it appears that extract($_POST) will provide "safe" variable values. ----- Original Message ----- From: <ed@home.homes2see.com> To: "Marek Kilimajer" <kilimajer@webglobe.sk> Cc: <php-general@lists.php.net> Sent: Wednesday, October 23, 2002 7:19 AM Subject: Re: [PHP] extract($_POST) So what you are actually saying is that the switchover to register_globals turned off and using $_POST or $_GET retrieval is only as secure as older php methods where you could just pass the variable by name? If each process can only get the variables that were passed to it why would it matter which method you used? Ed On Wed, 23 Oct 2002, Marek Kilimajer wrote: > Well, it is about the same in terms of security. > > Jason Wong wrote: > > >On Wednesday 23 October 2002 16:48, Marek Kilimajer wrote: > > > > > >>If you do extract($_POST) (or import_request_variables('GPC')), you do > >>exactly same thing as php would do if you have > >>register_global=on > >> > >> > > > >But if you're only doing extract($_POST) and not doing extract($_GET) etc as > >well, then you know all your variables have come from $_POST. > > > >Which is not the case if you have "register_globals = on" or use > >import_request_variables('GPC'), because you don't know where the variables > >came from. > > > > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php