Re: extract($_POST)

The security problem is the same one that's present when register_globals in ON. When you use extract($_POST), you are introducing variables into your script that you do not know about. Now it depends on how you write your scripts on whether its a security issue or not. You can have register_globals ON and have a script that's just a secure with register_globals OFF. It's all in how you use/define your variables. Say you have something like this: if($_POST['name'] == "John") { $admin = TRUE; } if($admin) { show_sensitive_data(); } Now, if you're using extract(), I can send $admin through the post data and you'll extract it into your script. That's where the security flaw lies, but the flaw is in the programming, not PHP. You can have a secure example by doing this: $admin = FALSE; if($_POST['name'] == "John") { $admin = TRUE; } if($admin) { show_sensitive_data(); } Now, regardless if the user tries to pass $admin through GET/POST/COOKIE, it's set to false before the comparison is made. This example would work regardless of the register_global settings. Read some more articles on register_globals for more examples. ---John Holmes... ----- Original Message ----- From: "Rick Emery" <remery@emeryloftus.com> To: <php-general@lists.php.net> Sent: Wednesday, October 23, 2002 2:33 PM Subject: Re: [PHP] extract($_POST) > However, if you do send 5000 POST variables, my script will be aware of, and use, only the the variables I reference in the PHP script that receives the form. So where is the security problem here? > > ----- Original Message ----- > From: "1LT John W. Holmes" <holmes072000@charter.net> > To: <php-general@lists.php.net> > Sent: Wednesday, October 23, 2002 1:24 PM > Subject: Re: [PHP] extract($_POST) > > > > On Wednesday 23 October 2002 16:48, Marek Kilimajer wrote: > > > If you do extract($_POST) (or import_request_variables('GPC')), you do > > > exactly same thing as php would do if you have > > > register_global=on > > > > But if you're only doing extract($_POST) and not doing extract($_GET) etc > as > > well, then you know all your variables have come from $_POST. > > > > Which is not the case if you have "register_globals = on" or use > > import_request_variables('GPC'), because you don't know where the > variables > > came from. > > Okay, so you know the variables came from POST, but you still don't know > what you are extracting. I can send you 5000 POST variables and you're going > to extract them all into your script. It's the same exact security issue > with register_globals = ON. There is no difference. > > ---John Holmes... > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > >