note 58775 deleted from security.globals by danbrown
| From: | danbrown@php.net | Date: | Thu, 15 Jan 2009 16:27:02 +0000 |
| Subject: | note 58775 deleted from security.globals by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-149274@lists.php.net to get a copy of this message | ||
Note Submitter: alan at xensource dot com
----
From the PHP Manual page on Using register_globals:
Do not use extract() on untrusted data, like user-input ($_GET, ...). If you do, for example, if you
want to run old code that relies on register_globals temporarily, make sure you use one of the
non-overwriting extract_type values such as EXTR_SKIP and be aware that you should extract in the
same order that's defined in variables_order within the php.ini.