RE: [PHP] extract($_POST)

> -----Original Message----- > From: 1LT John W. Holmes [mailto:holmes072000@charter.net] > Sent: 23 October 2002 19:51 > > Say you have something like this: > > if($_POST['name'] == "John") > { $admin = TRUE; } > > if($admin) > { show_sensitive_data(); } > > Now, if you're using extract(), I can send $admin through the > post data and > you'll extract it into your script. That's where the security > flaw lies, but > the flaw is in the programming, not PHP. > > You can have a secure example by doing this: > > $admin = FALSE; > if($_POST['name'] == "John") > { $admin = TRUE; } Or just $admin = $_POST['name']=="John"; Actually, I'd also collapse this into the subsequent if, and write it like this: if ($admin = $_POST['name']=="John"): show_sensitive_data(); endif; I love languages where assignments are expressions! Cheers! Mike --------------------------------------------------------------------- Mike Ford, Electronic Information Services Adviser, Learning Support Services, Learning & Information Services, JG125, James Graham Building, Leeds Metropolitan University, Beckett Park, LEEDS, LS6 3QS, United Kingdom Email: m.ford@lmu.ac.uk Tel: +44 113 283 2600 extn 4730 Fax: +44 113 283 3211