note 24632 deleted from security.globals by aidan
| From: | aidan@php.net | Date: | Wed, 08 Sep 2004 06:05:23 +0000 |
| Subject: | note 24632 deleted from security.globals by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-76205@lists.php.net to get a copy of this message | ||
Note Submitter: djresonance at yahoo dot com
----
There are a few functions posted on this page that can help to make it seem that register_globals is
turned on. However, that defeats the whole purpose of having register_globals off in the first
place. I think a better solution is to register each variable along with the request method from
which that variable came seperatly. To that end, I wrote a function which does exactly that. This
function accepts a variable number of arguments. The first argument should be the request method
you want to get the variable from, and the rest are the variables that you want to register in the
global namespace. I used $HTTP_*_VARS instead of $_* for compatibility with older versions of php:
/**
* Registers global variables
*
* This function takes global namespace $HTTP_*_VARS variables from input and if they exist,
* register them as a global variable so that scripts can use them. The first argument
* signifies where to pull the variable names from, and should be one of GET, POST, COOKIE, ENV, or
SERVER.
*
*/
function pt_register()
{
$num_args = func_num_args();
$vars = array();
if ($num_args >= 2) {
$method = strtoupper(func_get_arg(0));
if (($method != 'SESSION') && ($method != 'GET') &&
($method != 'POST') && ($method != 'SERVER') && ($method !=
'COOKIE') && ($method != 'ENV')) {
die('The first argument of pt_register must be one of the following: GET, POST,
SESSION, SERVER, COOKIE, or ENV');
}
$varname = "HTTP_{$method}_VARS";
global ${$varname};
for ($i = 1; $i < $num_args; $i++) {
$parameter = func_get_arg($i);
if (isset(${$varname}[$parameter])) {
global $$parameter;
$$parameter = ${$varname}[$parameter];
}
}
} else {
die('You must specify at least two arguments');
}
}
You can then register your global variables for use like this:
// register a GET var
pt_register('GET', 'user_id', 'password');
// register a server var
pt_register('SERVER', 'PHP_SELF');
// register some POST vars
pt_register('POST', 'submit', 'field1', 'field2',
'field3');