Re: extract($_POST)
| From: | 1LT John W. Holmes | Date: | Wed, 23 Oct 2002 18:24:17 +0000 |
| Subject: | Re: extract($_POST) | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-121148@lists.php.net to get a copy of this message | ||
> On Wednesday 23 October 2002 16:48, Marek Kilimajer wrote:
> > If you do extract($_POST) (or import_request_variables('GPC')), you do
> > exactly same thing as php would do if you have
> > register_global=on
>
> But if you're only doing extract($_POST) and not doing extract($_GET) etc
as
> well, then you know all your variables have come from $_POST.
>
> Which is not the case if you have "register_globals = on" or use
> import_request_variables('GPC'), because you don't know where the
variables
> came from.
Okay, so you know the variables came from POST, but you still don't know
what you are extracting. I can send you 5000 POST variables and you're going
to extract them all into your script. It's the same exact security issue
with register_globals = ON. There is no difference.
---John Holmes...