note 56015 deleted from language.variables.variable by tularis

Note Submitter: Zach at fsw dot cn Reason: bad code ---- Personally, I never been a big fan of having to put $_POST and $_GET everywhere myself. Maybe its lazy, or more likely, its just habit from php3 days. That said, there is a very good reason for it, and a very simple way to have both. To use the line from the comment below this <? foreach($_GET as $k=>$v) { $$k = htmlentities($v); } ?> with the one minor addition of htmlentities, and you got ease, and safety. Obviously would not work everywhere, but works in most. And if you do not have a clue what the fuss is over, Drop this into a file, save it as whatever.php <? echo $bobo; foreach($_GET as $k=>$v) { $$k = htmlentities($v); } echo $bobo; ?> Then load up, http://example.com/whatever.html?bobo=<script>alert(1)</script> I have always thought examples as above are a bit dumb, and they are - after all - you got go to the address for it to be effective - but at the same time, you can go to a website and have it happen to you either just forced, or hidden also. Either way - the above is also going to help with sql injection, and other internal messings around that are extremely easy to do.