note 55649 deleted from language.variables.variable by nlopess
| From: | nlopess@php.net | Date: | Tue, 10 Jan 2006 19:38:02 +0000 |
| Subject: | note 55649 deleted from language.variables.variable by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-101513@lists.php.net to get a copy of this message | ||
Note Submitter: trojjer
----
Note for "James" from the last entry:
Don't you know that that is why REGISTER_GLOBALS was turned off by default, in the first place?
You have to be very careful when dealing with user input, especially GET and POST; because having
variables automatically assigned to the names of those values is dangerous, and can lead to someone
manipulating the values of _other_ variables within the script, if they are of the same name.
In any case, you could shorten those loops quite a bit by using foreach (although I would take heed
of the above warning; or save myself any work at all and just turn the pre-existing feature on
again, if I was working on a LAN or something, that I knew was 'safe'):
<?php
foreach($_GET as $k=>$v) { $$k = $v; }
?>
Maybe you didn't know that REGISTER_GLOBALS did the same thing before? It's recommended
that you leave it set as false, though, as I said, in all newer PHP versions. You're advised to
just stick with the 'superglobals' -- if you just wanted to shorten the typing and be
(very) lazy when it comes to not having to repeat $_GET or $_POST, lol, you could just assign, for
example, $_G and $_P as aliases to the arrays (or references, if you want to save on the extra
memory space that would be allotted if they were duplicates, i.e. $_G =& $_GET).