Security question: getenv()

From: Date: Fri, 09 Nov 2001 16:06:15 +0000
Subject: Security question: getenv()
Groups: php.general 
Request: Send a blank email to php-general+get-74026@lists.php.net to get a copy of this message
Happy Friday! I don't know anything about the innards of the PHP/Apache relationship. I am wondering if there is a security advantage to using the getenv() function to access an environment variable, instead of using the $HTTP_SERVER_VARS array, or, if register_globals is on, the global version of the variable. Using $SERVER_NAME as an example, and assuming register_globals is on, if $foo = gentenv("SERVER_NAME"); $bar = $HTTP_SERVER_VARS["SERVER_NAME"]; are $foo, $bar and $SERVER_NAME guaranteed to have the same value? Can a cracker poison one of these but not the other? Does getenv() get the value from Apache or PHP's namespace? You know what I'm getting at, right? ;) TIA Happy Friday! Kirk

« previous php.general (#74026) next »