note 19780 deleted from ref.variables by nlopess
| From: | nlopess@php.net | Date: | Mon, 28 Jun 2004 14:26:35 +0000 |
| Subject: | note 19780 deleted from ref.variables by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-72011@lists.php.net to get a copy of this message | ||
Note Submitter: maxim@maxim.cx
----
Whoever is writing an application for a world-wide-use and wants to use $_GET etc... but cannot
because of the compatibility problems, look at this peace of code.
It will help you to avoid the trouble by rewriting the variables yourself in some silly config file
prepended to each script.
<?php
/// by Maxim Maletsky <maxim@maxim.cx>
$evil_vars = Array('GET', 'POST', 'COOKIE', 'SERVER',
'ENV', 'REQUEST', 'SESSION');
$php_version = preg_replace("/[^\d]/", '', phpversion());
for($i=0; $i<sizeof($evil_vars); $i++) {
if(is_array(${"HTTP_{$evil_vars[$i]}_VARS"})) {
foreach(${"HTTP_{$evil_vars[$i]}_VARS"} as $var=>$val) {
if($php_version<410) {
$GLOBALS["_{$evil_vars[$i]}"][$var] = $val;
}
unset($$key);
}
}
unset(${"HTTP_{$evil_vars[$i]}_VARS"});
}
?>
What does it do?
It loops every $HTTP_*_VARS variable, if you run a version below 4.1.0 then it will create you a
GLOBAL $_* var and will unset you the old ones.
This means that anyone on any version sending you a variable will not get it processed in the script
unless it was referenced as $_*['var'].
I.E:
www.yoursite.com/file.php?some=data
<?
// that piece of code here
echo $some; // will not come up
echo $_GET['some'] // will show up just as it would in versions above 4.1.0
function test() {
echo $_GET['some']; // will also work because a fake $_GET is GLOBAL
}
?>
Cheers,
Maxim Maletsky