RE: [PHP] _SERVER variable insd prnt sttmnt
| From: | Andrew Chase | Date: | Tue, 30 Apr 2002 16:34:03 +0000 |
| Subject: | RE: [PHP] _SERVER variable insd prnt sttmnt | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-95393@lists.php.net to get a copy of this message | ||
For the sake of legibility you could always assign the contents of
$_SERVER['PHP_SELF'] to another variable before using it in the print
statement:
$PHP_SELF = $_SERVER['PHP_SELF'];
print "<LI><A HREF='$PHP_SELF?letter=$chars[$cnt]'>";
Shouldn't be a problem security-wise as long as register_globals is off;
Even if somebody tried to pass an arbitrary value to PHP_SELF in the query
string, it would only show up in $_GET['PHP_SELF']. It also provides a quick
way to bring pre- 4.1.2 scripts relying on the old global $PHP_SELF up to
date.
-Andy
> -----Original Message-----
> From: 1LT John W. Holmes [mailto:holmes072000@charter.net]
> Sent: Monday, April 29, 2002 8:30 AM
> To: php-general@lists.php.net
> Subject: Re: [PHP] _SERVER variable insd prnt sttmnt
>
>
> > > // print "<LI><A
> > > HREF='$_SERVER['PHP_SELF']?letter=$chars[$cnt]'>" .
>
> This is the problem with not breaking out of a string to display
> a variable.
> Ideally, you would do it this way:
>
> print "<LI><A HREF='" . $_SERVER['PHP_SELF'] .
> "?letter=" . $chars[$cnt] .
> "'>";
>
> But some people just have a problem with doing it that way, so you can use
> braces.
>
> print "<LI><A
> HREF='{$_SERVER['PHP_SELF']}?letter={$chars[$cnt]}'>";