Re: Verry strange GET behaviour
| From: | Marek Kilimajer | Date: | Tue, 07 Oct 2003 16:05:50 +0000 |
| Subject: | Re: Verry strange GET behaviour | ||
| References: | 1 2 3 4 5 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-165322@lists.php.net to get a copy of this message | ||
Ben Edwards wrote:
what I don't understand is if $_GET is being used people can just change the URL anyway so why is it an issue? BenAll that it is about that if you have code like this: if($user=='admin' && $pwd=='secretpassword') { $admin=true; } and register_globals on someone can pass a get (or to have it more confortable cookie) variable and gain admin access. Sure, you should initialize all your variables with safe values and you are fine: $admin=false; if($user=='admin' && $pwd=='secretpassword') { $admin=true; }