note 91260 deleted from reserved.variables.post by danbrown

Note Submitter: Sijmen Ruwhof ---- @jairhumberto at gmail dot com - 31-Jul-2008 01:26 The code you provided does the same thing as the PHP configuration option 'register_globals'. The register_globals option is extremely dangerous from a security perspective, because an user can inject arbitrary variables into the script. It can result in remote code execution and authentication bypass for example. So never ever do the following: <?php foreach(${"_" . $_SERVER["REQUEST_METHOD"]} as $k=>$v) $$k=$v; ?> The code above is frequently found in various scripts and caused a lot of security problems ...