Re: Session Variable Security
| From: | Chris Shiflett | Date: | Thu, 30 Sep 2004 17:31:28 +0000 |
| Subject: | Re: Session Variable Security | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-198313@lists.php.net to get a copy of this message | ||
--- GH <GaryHotko@gmail.com> wrote:
> Brian:
>
> What way should you not reference session variables? I seem to have
> missed that part of the discussion... Sorry.
I think he meant to be wary of register_globals and thinking you're
referencing a session variable when you use $foo rather than
$_SESSION['foo']. With register_globals enabled, you can't be sure of the
data's origin.
Chris
=====
Chris Shiflett - http://shiflett.org/
PHP Security - O'Reilly HTTP Developer's Handbook - Sams
Coming December 2004 http://httphandbook.org/