note 104985 deleted from function.parse-str by danbrown
| From: | danbrown@php.net | Date: | Thu, 21 Jul 2011 16:00:23 +0000 |
| Subject: | note 104985 deleted from function.parse-str by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-181758@lists.php.net to get a copy of this message | ||
Note Submitter: Jonah Braun
----
As bubjavier noted, using parse_str() without the second parameter is really dangerous. PHPMyAdmin
recently fixed a serious vulnerability caused by using:
<?php
parse_str($_SERVER['QUERY_STRING']);
?>
Which the documentation suggests to do. Be sure to only use parse_str() with the second parameter!
Example:
<?php
parse_str($_SERVER['QUERY_STRING'], $get_vars);
?>