note 118922 added to function.parse-str

DO NOT make a practice of using the one-parameter version of this function, particularly for processing user input. It's susceptible to exactly the same sorts of bugs and security problems as the old "register_globals" setting. I'm actually rather surprised there's not a warning message about it on this page. If you use the one-parameter version of parse_str() in global scope (i.e. outside of any functions), it lets the user override ANY global variables in your script, even superglobals like $_GET and $_REQUEST. If you use it inside a function, it can't touch your global variables but it can still override any variables already defined in the function, or populate variables that later get accessed without prior initialization. You can guard against these problems by making sure to call parse_str() only in function/method scope, and before any variable declarations, and making sure to initialize all variables before accessing them. But why leave yourself open? Just use the two-parameter version of parse_str(). // BAD parse_str($_SERVER['QUERY_STRING']); echo $foo; // BETTER parse_str($_SERVER['QUERY_STRING'], $urlparams); echo $urlparams['foo']; ---- Server IP: 72.52.91.14 Probable Submitter: 2404:130:0:1000:8450:ee62:cb82:bd91 ---- Manual Page -- http://php.net/manual/en/function.parse-str.php Edit -- https://master.php.net/note/edit/118922 Del: integrated -- https://master.php.net/note/delete/118922/integrated Del: useless -- https://master.php.net/note/delete/118922/useless Del: bad code -- https://master.php.net/note/delete/118922/bad+code Del: spam -- https://master.php.net/note/delete/118922/spam Del: non-english -- https://master.php.net/note/delete/118922/non-english Del: in docs -- https://master.php.net/note/delete/118922/in+docs Del: other reasons-- https://master.php.net/note/delete/118922 Reject -- https://master.php.net/note/reject/118922 Search -- https://master.php.net/manage/user-notes.php