note 42853 added to security.globals

Some have taken to using extract() as a means to deal with old scripts where register_globals has been disabled, but is required for the script's normal operation. This is a _bad_idea_ for the reason that it can allow a user to overwrite predefined server variables if used improperly. for example: <?php // the evil code that one might use to extract the contents of a superglobal extract($_GET); if ($REMOTE_ADDR=='127.0.0.1') { do_stuff(); } ?> one might be inclined to send a query string like: http://foo.com/script.php?REMOTE_ADDR=127.0.0.1 or http://foo.com/script.php?_SERVER[REMOTE_ADDR]=127.0.0.1 Since extract() executes after the predefined variable has been set, it will quite happily overwrite variables that should be system defined. if you do use extract, be sure to extract _all_ server/system variables after $_GET/$_POST/$_COOKIE/$_SESSION. ---- Manual Page -- http://www.php.net/manual/en/security.globals.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+42853 Delete -- http://master.php.net/manage/user-notes.php?action=delete+42853&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+42853&report=yes Search -- http://master.php.net/manage/user-notes.php