note 96035 deleted from function.parse-str by sobak
| From: | sobak@php.net | Date: | Thu, 17 Nov 2016 07:54:44 +0000 |
| Subject: | note 96035 deleted from function.parse-str by sobak | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-207144@lists.php.net to get a copy of this message | ||
Note Submitter: me at bubjavier dot com
----
be careful using parse_str() without the [array &$arr] parameter, as this may override values of
global and existing variables.
<?php
$var1 = 1;
parse_str('var1=one&var2=two');
// $var1 is now 'one'
?>
Also may lead to variable value injection when used with user input data:
<?php
$_POST['range'] = 'min=1&max=5&important_var=important_value_no_more';
$important_var = 'important_value';
parse_str($_POST['range']);
?>