note 104985 added to function.parse-str
| From: | JonahBraun at osu1 dot php dot net | Date: | Wed, 20 Jul 2011 18:32:29 +0000 |
| Subject: | note 104985 added to function.parse-str | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-181724@lists.php.net to get a copy of this message | ||
As bubjavier noted, using parse_str() without the second parameter is really dangerous. PHPMyAdmin
recently fixed a serious vulnerability caused by using:
<?php
parse_str($_SERVER['QUERY_STRING']);
?>
Which the documentation suggests to do. Be sure to only use parse_str() with the second parameter!
Example:
<?php
parse_str($_SERVER['QUERY_STRING'], $get_vars);
?>
----
Server IP: 69.147.83.197
Probable Submitter: 174.3.167.212
----
Manual Page -- http://www.php.net/manual/en/function.parse-str.php
Edit -- https://master.php.net/note/edit/104985
Del: integrated -- https://master.php.net/note/delete/104985/integrated
Del: useless -- https://master.php.net/note/delete/104985/useless
Del: bad code -- https://master.php.net/note/delete/104985/bad+code
Del: spam -- https://master.php.net/note/delete/104985/spam
Del: non-english -- https://master.php.net/note/delete/104985/non-english
Del: in docs -- https://master.php.net/note/delete/104985/in+docs
Del: other reasons-- https://master.php.net/note/delete/104985
Reject -- https://master.php.net/note/reject/104985
Search -- https://master.php.net/manage/user-notes.php