Re: Session vars vs. POST/GET vars?
| From: | Noel Wade | Date: | Sat, 11 Jan 2003 10:39:45 +0000 |
| Subject: | Re: Session vars vs. POST/GET vars? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-131235@lists.php.net to get a copy of this message | ||
Nevermind, just found the $HTTP_SESSION_VARS array...
Thanks anyways! Take care,
--Noel
"Noel Wade" <noelwade@attbi.com> wrote in message
news:20030111103335.60382.qmail@pb1.pair.com...
> Hi all,
>
> So I have a session variable; but with register_globals active on the
server
> I'm hosted at (no way to turn it off), just checkng for "$varX" in my
script
> could retrieve the session variable, a GET variable with the same name, or
a
> POST variable with the same name - and as a security concern, someone
could
> use a GET request (http://somehost/mypage.php?varX=0) to spoof the script
> into thinking that "varX" is the wrong value.
>
> So, is there any way in a script to specify that I want to retrieve the
> value stored in the registered session_variable("varX")??
>
> Thanks,
>
> --Noel
>
>
>