Re: Re: setcookie security concerns [medium]

Rafael wrote:

Actually, you receive $set via GET, so you should use $_GET instead of $_POST. A lot of people use $_REQUEST (wich is a combination of $_POST, $_GET and $_COOKIE -check the manual), but I read somewhere that this isn't a good practice, though I don't recall why :p

From what I've read (PHP Cookbook by Sklar and other sources) the reason why you don't want to use $_REQUEST is because it holds all the variables from six global arrays, namely $_GET, $_POST, $_FILES, $_COOKIE, $_SERVER, and $_ENV. When PHP creates $_REQUEST, it does so by adding the global arrays together in a certain order, namely EGPCS. Normally, this would be OK, but if two (or more) of those arrays have a key with the same name, then that key value will be replaced with the last value read. For example, the value provided by $_GET('mykey') will be replaced by the value found in $_COOKIE ('mykey') in generating the value for $_REQUEST('mykey'). So, if you use $_REQUEST, then you can't reply upon where its values are derived. tedd -- -------------------------------------------------------------------------------- http://sperling.com