Re: extract($_POST)

Seems to me that if you don't bother to validate the variables (whether they come from _POST/_GET or register_globals=on) then it doesn't really matter. It's not that much harder for me to hack your scripts... if putting it in the query string doesn't work, I'll try doing it via POST'ing, and if that doesn't work I'll create my own cookie. I agree that using _POST helps you keep track of where you expect variables to come from, but if you want to be secure you still need to validate them to make sure the values are what you expect (or at least don't contain what you don't want). just my 2 cents. On Wed, 23 Oct 2002, Rick Emery wrote: > Statements, such as "Well, it is about the same in terms of security." > are simply too vague to be useful. > > Mr. Lerdorf's explanation provides the most definitive answer concerning > this issue. He should know; he and others created/wrote PHP. > > If you use extract($_POST), then the values contained therein cannot be > corrupted by a user calling the PHP script directly with values in the > URL line. Whereas, if one were to rely on automatically registered > variables, then values passed from a form could be overwritten via the > URL line; a definite security breach. > > Therefore, given Rasmus' explanation, it appears that extract($_POST) > will provide "safe" variable values. > > ----- Original Message ----- > From: <ed@home.homes2see.com> > To: "Marek Kilimajer" <kilimajer@webglobe.sk> > Cc: <php-general@lists.php.net> > Sent: Wednesday, October 23, 2002 7:19 AM > Subject: Re: extract($_POST) > > > > So what you are actually saying is that the switchover to > register_globals turned off and using $_POST or $_GET retrieval is only as > secure as older php methods where you could just pass the variable by > name? If each process can only get the variables that were passed to it > why would it matter which method you used? > > Ed > > > On Wed, 23 Oct 2002, Marek Kilimajer wrote: > > > Well, it is about the same in terms of security. > > > > Jason Wong wrote: > > > > >On Wednesday 23 October 2002 16:48, Marek Kilimajer wrote: > > > > > > > > >>If you do extract($_POST) (or import_request_variables('GPC')), you do > > >>exactly same thing as php would do if you have > > >>register_global=on > > >> > > >> > > > > > >But if you're only doing extract($_POST) and not doing extract($_GET) etc as > > >well, then you know all your variables have come from $_POST. > > > > > >Which is not the case if you have "register_globals = on" or use > > >import_request_variables('GPC'), because you don't know where the > > >variables > > >came from. > > > > > > > > > > > > > > > -- > > PHP General Mailing List (http://www.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > >