Re: Re: setcookie security concerns [medium]

(Comments inline) tedd wrote: [···]

From what I've read (PHP Cookbook by Sklar and other sources) the reason why you don't want to use $_REQUEST is because it holds all the variables from six global arrays, namely $_GET, $_POST, $_FILES, $_COOKIE, $_SERVER, and $_ENV.

Actually, the super-global variables used in $_REQUEST are $_GET, $_POST and $_COOKIE¹, and though there is a "gpc" directive I'm not sure if you can control the order they are read (but my guess would be that you do) ¹http://php.net/manual/en/reserved.variables.php#reserved.variables.request

When PHP creates $_REQUEST, it does so by adding the global arrays together in a certain order, namely EGPCS. Normally, this would be OK, but if two (or more) of those arrays have a key with the same name, then that key value will be replaced with the last value read. For example, the value provided by $_GET('mykey') will be replaced by the value found in $_COOKIE ('mykey') in generating the value for $_REQUEST('mykey'). So, if you use $_REQUEST, then you can't reply upon where its values are derived.

Well, I still don't remember the reason, but this could be a valid one :) By the way, these are variables (arrays), so you should use square-brackets instead of parenthesis to specify an index (e.g. $_SERVER['SCRIPT_NAME']) -- Atentamente, J. Rafael Salazar Magaña Innox - Innovación Inteligente Tel: +52 (33) 3615 5348 ext. 205 / 01 800 2-SOFTWARE http://www.innox.com.mx