note 6238 deleted from ref.session by yohgaki
| From: | yohgaki@php.net | Date: | Sat, 19 Jan 2002 06:14:59 +0000 |
| Subject: | note 6238 deleted from ref.session by yohgaki | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-25085@lists.php.net to get a copy of this message | ||
Editor's note: This is a security feature. You shall not trust data coming from clients.
Remember that you CANNOT override a EXISTING session variable with a FORM(post), e.g.:
First page:
<?
$something = "blah";
session_register("something");
?>
<form method="post">
<input type="text" name="something">
</post>
And let's say you typed "fla fla" in the something field.
Second page:
<?
SESSION_REGISTER("something");
$something = $something;
echo $something;
?>
The second page will return "blah". You cann't override an existing session variable
with a HTTP POST Variable.
Correct (second page):
<?
SESSION_REGISTER("something");
$something = $HTTP_POST_VARS["something"];
echo $something;
?>
This will return the value you inserted into the input field.