note 6238 modified in Session handling functions by ronabop
| From: | ronabop@php.net | Date: | Fri, 25 Aug 2000 08:43:04 +0000 |
| Subject: | note 6238 modified in Session handling functions by ronabop | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-3158@lists.php.net to get a copy of this message | ||
Editor's note: This is a security feature. You shall not trust data coming from clients.
Remember that you CANNOT override a EXISTING session variable with a FORM(post), e.g.:
First page:
<?
$something = "blah";
session_register("something");
?>
<form method="post">
<input type="text" name="something">
</post>
And let's say you typed "fla fla" in the something field.
Second page:
<?
SESSION_REGISTER("something");
$something = $something;
echo $something;
?>
The second page will return "blah". You cann't override an existing session variable
with a HTTP POST Variable.
Correct (second page):
<?
SESSION_REGISTER("something");
$something = $HTTP_POST_VARS["something"];
echo $something;
?>
This will return the value you inserted into the input field.
http://www.php.net/manual/session-handling-functions.php