Re: Conversion of period and space for $_GET, $_REQUEST, etc. is rather senseless
| From: | Rasmus Lerdorf | Date: | Mon, 04 Jul 2005 02:48:17 +0000 |
| Subject: | Re: Conversion of period and space for $_GET, $_REQUEST, etc. is rather senseless | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-218064@lists.php.net to get a copy of this message | ||
Joe Krahn wrote:
> PHP imports GET and POST data to array elements by senselessly
> converting periods and spaces to underscore. The intent is to make
> strings variable-name compatible for conversion directly into global
> variables via import_request_variables or register_globals.
>
> String-to-variable name mangling should only occur when being converted
> to variable names, but should be left as is when accessed as array
> elements. The current implementation is particularly bad because it
> mangles only periods and spaces, but leaves alone other special/unusual
> characters. Furthermore, the direct conversion into global name space is
> discouraged for security reasons.
>
> A feature-request was made related to this, but it was marked as "Won't
> Fix", primarily due to compatibility concerns. However, I think it's a
> poor design, and there must be some compatible way to move beyond this
> misfeature.
>
> Do other people really want to keep the period/space name mangling for
> array keys, and not just for variable names? And, what happens when
> importing other special characters to variable names?
The reason '.' is special is because browsers create these
period-seperated variable names automatically when clicking on an image
submit button. Changing this will break a whole lot of applications for
no reason.
-Rasmus