note 55808 deleted from security.globals by philip
| From: | philip@php.net | Date: | Wed, 28 Feb 2007 16:38:31 +0000 |
| Subject: | note 55808 deleted from security.globals by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-123958@lists.php.net to get a copy of this message | ||
Note Submitter: argentus at ukr dot net
----
I have found out a method which seems to me the best. I've written my own version of extract.
It works as follows:
<?php
safe_extract($_POST, "post", array("param1", "param2"));
// and now I can use the following variables:
echo "param1 is <b>$post_param1_html</b><br />";
mysql_query("SELECT * FROM sometable WHERE something = '$post_param2_slashes'");
if($post_param1_unsafe != $post_param2_unsafe)
// do something.
?>
I think it to be more convenient than using the required functions manually and more safe than that,
and surely much more safe than register_globals = On.
The code is very simple. You can write your own version, of course, but I'll also show mine:
<?php
function make_variables($key, $value, $prefix)
{
$GLOBALS["{$prefix}_{$key}_unsafe"] = $value;
$GLOBALS["{$prefix}_{$key}_slashes"] = addslashes($value);
$GLOBALS["{$prefix}_{$key}_url"] = urlencode($value);
$GLOBALS["{$prefix}_{$key}_html"] = htmlspecialchars($value);
$GLOBALS["{$prefix}_{$key}_url_html"] = htmlspecialchars(urlencode($value));
}
function safe_extract($array, $prefix, $keys)
{
if(count(array_diff(array_values($keys), array_keys($array))) != 0)
return false;
foreach($keys as $key)
make_variables($key, $array[$key], $prefix);
return true;
}
?>