Re: variables always overwriting session variables?!

This depends on variables_order directive in php.ini. The default order is "EGPCS" - that means that variables will be initialized in order: Environment, Get, Post, Cookie, Server. The newer value always override the old value for the variable with the same name. As you can see, GET variables would never overwrite POST, cookie and server variables. Check your php.ini, maybe you'll change something in it. As for me, I'd prefer to place E after C ("GPCES") to prevent any of user-provided variables rewriting environment. Also consider set register_globals to Off, and all the mentioned variables won't be exported to the global namespace, only HTTP_(GET|POST|COOKIE|SESSION|SERVER)_VARS arrays, so you will refer to the variables as those arrays elements. In this case, you can have different values for HTTP_GET_VARS['foo'] and HTTP_POST_VARS['foo'], and none of them would affect each other. This is the most secure way, while needs some discipline :). "Boget, Chris" wrote: > > The problem of the URL stored variables (GET) possible > > overwriting those in a form (POST), is commonly overlooked. > > I thought it was that > > COOKIE vars always overwrote > POST vars always overwrote > GET vars > of the same name > > ? > So GET variables have the highest priority? That would seem > like a serious hole... > > Chris -- Best regards, Max A. Derkachev mailto:kot@books.ru Symbol-Plus Publishing Ltd. phone: +7 (812) 265-0054, 265-1228, phone/fax: 567-8775 http://www.Books.Ru -- All Books of Russia