Security question: getenv()
| From: | Johnson, Kirk | Date: | Fri, 09 Nov 2001 16:06:15 +0000 |
| Subject: | Security question: getenv() | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-74026@lists.php.net to get a copy of this message | ||
Happy Friday!
I don't know anything about the innards of the PHP/Apache relationship. I am
wondering if there is a security advantage to using the getenv() function to
access an environment variable, instead of using the $HTTP_SERVER_VARS
array, or, if register_globals is on, the global version of the variable.
Using $SERVER_NAME as an example, and assuming register_globals is on, if
$foo = gentenv("SERVER_NAME");
$bar = $HTTP_SERVER_VARS["SERVER_NAME"];
are $foo, $bar and $SERVER_NAME guaranteed to have the same value? Can a
cracker poison one of these but not the other? Does getenv() get the value
from Apache or PHP's namespace?
You know what I'm getting at, right? ;)
TIA
Happy Friday!
Kirk