note 55649 deleted from language.variables.variable by nlopess

From: Date: Tue, 10 Jan 2006 19:38:02 +0000
Subject: note 55649 deleted from language.variables.variable by nlopess
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-101513@lists.php.net to get a copy of this message
Note Submitter: trojjer ---- Note for "James" from the last entry: Don't you know that that is why REGISTER_GLOBALS was turned off by default, in the first place? You have to be very careful when dealing with user input, especially GET and POST; because having variables automatically assigned to the names of those values is dangerous, and can lead to someone manipulating the values of _other_ variables within the script, if they are of the same name. In any case, you could shorten those loops quite a bit by using foreach (although I would take heed of the above warning; or save myself any work at all and just turn the pre-existing feature on again, if I was working on a LAN or something, that I knew was 'safe'): <?php foreach($_GET as $k=>$v) { $$k = $v; } ?> Maybe you didn't know that REGISTER_GLOBALS did the same thing before? It's recommended that you leave it set as false, though, as I said, in all newer PHP versions. You're advised to just stick with the 'superglobals' -- if you just wanted to shorten the typing and be (very) lazy when it comes to not having to repeat $_GET or $_POST, lol, you could just assign, for example, $_G and $_P as aliases to the arrays (or references, if you want to save on the extra memory space that would be allotted if they were duplicates, i.e. $_G =& $_GET).

« previous php.notes (#101513) next »