note 91260 added to reserved.variables.post

@jairhumberto at gmail dot com - 31-Jul-2008 01:26 The code you provided does the same thing as the PHP configuration option 'register_globals'. The register_globals option is extremely dangerous from a security perspective, because an user can inject arbitrary variables into the script. It can result in remote code execution and authentication bypass for example. So never ever do the following: <?php foreach(${"_" . $_SERVER["REQUEST_METHOD"]} as $k=>$v) $$k=$v; ?> The code above is frequently found in various scripts and caused a lot of security problems ... ---- Server IP: 91.199.167.18 Probable Submitter: 213.46.80.117 ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.post.php Edit -- https://master.php.net/note/edit/91260 Del: integrated -- https://master.php.net/note/delete/91260/integrated Del: useless -- https://master.php.net/note/delete/91260/useless Del: bad code -- https://master.php.net/note/delete/91260/bad+code Del: spam -- https://master.php.net/note/delete/91260/spam Del: non-english -- https://master.php.net/note/delete/91260/non-english Del: in docs -- https://master.php.net/note/delete/91260/in+docs Del: other reasons-- https://master.php.net/note/delete/91260 Reject -- https://master.php.net/note/reject/91260 Search -- https://master.php.net/manage/user-notes.php