Re: extract($_POST)
| From: | 1LT John W. Holmes | Date: | Wed, 23 Oct 2002 18:18:54 +0000 |
| Subject: | Re: extract($_POST) | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-121145@lists.php.net to get a copy of this message | ||
> You are correct. I'd never considered using the URL due to lack of
security; that is, a user can add URL parameters that hijack the session and
make it do bad things, or expose data that you (the developer) do not want
exposed.
I can do the same thing to a cookie. Neither method is "secure" because the
value comes from the user.
---John Holmes...
> ----- Original Message -----
> From: "@ Edwin" <copperwalls@hotmail.com>
> To: "Rick Emery" <remery@emeryloftus.com>
> Cc: <ed@home.homes2see.com>; <php-general@lists.php.net>
> Sent: Wednesday, October 23, 2002 9:19 AM
> Subject: Re: [PHP] extract($_POST)
>
>
> Hello,
>
> I don't think that's what the manual says:
>
> ---------->
>
> Passing the Session ID
>
> There are two methods to propagate a session id:
>
> * Cookies
> * URL parameter
>
> The session module supports both methods. Cookies are optimal, but since
> they are not reliable (clients are not bound to accept them), we cannot
rely
> on them. The second method embeds the session id directly into URLs.
>
> http://www.php.net/manual/en/ref.session.php
>
> - E
>
> On Wednesday, October 23, 2002 10:49 PM
> "Rick Emery" <remery@emeryloftus.com> wrote:
>
> > Ed,
> >
> > Elsewhere, you stated that you will not use cookies, because one-third
> > of your constituency will have cookies turned off. yet, you will use
> > sessions. Sessions processing depends on cookies being on.
>
> ...[snip]...
>
>