Re: variables??

From: Date: Wed, 26 Mar 2003 01:14:54 +0000
Subject: Re: variables??
References: 1  Groups: php.general 
Request: Send a blank email to php-general+get-141048@lists.php.net to get a copy of this message
No, it is more secure. The problem with register_globals is that ALL variables become global - not just the ones you want to be. Example: if(something) $authorized = true; if($authorized){ ...do something requiring security... } A hacker could easily go to script.php?authorized=1, and gain access. If you only allow one variable in that ($_GET['var']), you will know that the variable is from an outside source, and can act accordingly. John W. Holmes wrote:
It is considered more secure to declare the variable explicitly. $var = $_GET["var"];
Ummm... that's the same result as having register_globals on (basically). You're not helping anything and it's certainly not any more "secure". ---John W. Holmes... PHP Architect - A monthly magazine for PHP Professionals. Get your copy today. http://www.phparch.com/
I'm having a problem with form data being recognized by a php
       
script.
If I send information with a GET the variable data appears in
       
$GET[var]
but not $var. >
       
-- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
-- The above message is encrypted with double rot13 encoding. Any unauthorized attempt to decrypt it will be prosecuted to the full extent of the law.

« previous php.general (#141048) next »