note 42853 deleted from security.globals by aidan

Note Submitter: ---- Some have taken to using extract() as a means to deal with old scripts where register_globals has been disabled, but is required for the script's normal operation. This is a _bad_idea_ for the reason that it can allow a user to overwrite predefined server variables if used improperly. for example: <?php // the evil code that one might use to extract the contents of a superglobal extract($_GET); if ($REMOTE_ADDR=='127.0.0.1') { do_stuff(); } ?> one might be inclined to send a query string like: http://foo.com/script.php?REMOTE_ADDR=127.0.0.1 or http://foo.com/script.php?_SERVER[REMOTE_ADDR]=127.0.0.1 Since extract() executes after the predefined variable has been set, it will quite happily overwrite variables that should be system defined. if you do use extract, be sure to extract _all_ server/system variables after $_GET/$_POST/$_COOKIE/$_SESSION.