global vars on/off

**Johannes Vogel** · Feb 7 '07, 08:15 AM

Re: global vars on/off

Hi S

Sonnich wrote:

I was trying to understand this...

PHP: Variables From External Sources - Manual

http://www.php.net/manual/en/language.variables.external.php

Variables From External Sources

I wonder what teh community has to say about this...
I need to get some vars something.php?v ar=blabla... I can get the
$var, but also $_request["var"].
And there is also the file_get_conten ts('php://input'), but then I
have to do some more.
What do people have to say about this?

Get it by using $_GET['var'] and proof the content with is* functions.

HTH, Johannes

**P Pulkkinen** · Feb 7 '07, 09:35 AM

Re: global vars on/off

"Sonnich" <sonnich.jensen @elektrobit.com wrote:

I need to get some vars something.php?v ar=blabla... I can get the
$var, but also $_request["var"].

Do you have
register_global s = on
in php.ini?

That's "dangerous" . I mean something that is at least considered dangerous.
If you put register_global s = off, and use $_request, $_get, $_post and
$_cookie, you'll surely know where your variables come from.

**Erwin Moller** · Feb 7 '07, 11:05 AM

Re: global vars on/off

Sonnich wrote:

Hi all!
>
I was trying to understand this...

PHP: Variables From External Sources - Manual

http://www.php.net/manual/en/language.variables.external.php

Variables From External Sources

>
I wonder what teh community has to say about this...
>
I need to get some vars something.php?v ar=blabla... I can get the
$var, but also $_request["var"].

What do you mean excactly?

Is $_GET["var"] NOT working for you?

And there is also the file_get_conten ts('php://input'), but then I
have to do some more.

No need to complicate things.
PHP will fill the superglobal $_GET just fine for you.
It will also fill $_POST if you receive a form send with Method="POST" (in
the HTML).

And don't use $_request because it doesn't exist, unless you created it in
your script.
Use $_REQUEST instead. :-)
But better: not use $_REQUEST at all, because using it only shows you don't
know where your input comes from (Cookie? Get? Post?). Just use the
superglobal you KNOW will contain the information.

Regards,
Erwin Moller

>
What do people have to say about this?
>
S

**Vincent Delporte** · Feb 7 '07, 01:25 PM

Re: global vars on/off

On Wed, 7 Feb 2007 11:24:23 +0200, "P Pulkkinen"
<perttu.POISTAT AMA.pulkkinen@P OISTATAMA.elisa net.fiwrote:

>If you put register_global s = off, and use $_request, $_get, $_post and
>$_cookie, you'll surely know where your variables come from.

Why is it dangerous to use globals, and not know where the data came
from?

**Jerry Stuckle** · Feb 7 '07, 04:35 PM

Re: global vars on/off

Vincent Delporte wrote:

On Wed, 7 Feb 2007 11:24:23 +0200, "P Pulkkinen"
<perttu.POISTAT AMA.pulkkinen@P OISTATAMA.elisa net.fiwrote:

>If you put register_global s = off, and use $_request, $_get, $_post and
>$_cookie, you'll surely know where your variables come from.

>
Why is it dangerous to use globals, and not know where the data came
from?

Well, as a simple example, let's say you put a value in your $_SESSION like:

$_SESSION('admi n') = 1;

This indicates the person has signed on and is authorized to access your
admin screens. Now what happens if I do:

Example Domain

http://www.example.com/admin?admin=1

With register_global s on, I could access your admin screens even though
I'm not signed on, because both could set the variable $admin to 1.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

**Rik** · Feb 7 '07, 04:35 PM

Re: global vars on/off

Jerry Stuckle <jstucklex@attg lobal.netwrote:

Vincent Delporte wrote:

>On Wed, 7 Feb 2007 11:24:23 +0200, "P Pulkkinen"
><perttu.POISTA TAMA.pulkkinen@ POISTATAMA.elis anet.fiwrote:

>>If you put register_global s = off, and use $_request, $_get, $_post
>>and $_cookie, you'll surely know where your variables come from.

> Why is it dangerous to use globals, and not know where the data came
>from?

>
Well, as a simple example, let's say you put a value in your $_SESSION
like:
>
$_SESSION('admi n') = 1;
>
This indicates the person has signed on and is authorized to access your
admin screens. Now what happens if I do:
>

Example Domain

http://www.example.com/admin?admin=1

>
With register_global s on, I could access your admin screens even though
I'm not signed on, because both could set the variable $admin to 1.

Indeed, allthough this is offcourse bad coding. Every variable should be
initialised, and every $_SESSION / $_POST / $_GET / $_COOKIE should be
accessed like such. So, when coding correctly, having register_global s on
is not a problem. However, when making a tiny mistake or when relying in
register_global s, that's where it goes wrong. In short, unless you're
infallable having register_global s off is just better.
--
Rik Wasmus

**Sanders Kaufman** · Feb 7 '07, 05:45 PM

Re: global vars on/off

Vincent Delporte wrote:

On Wed, 7 Feb 2007 11:24:23 +0200, "P Pulkkinen"

>If you put register_global s = off, and use $_request, $_get, $_post and
>$_cookie, you'll surely know where your variables come from.

>
Why is it dangerous to use globals, and not know where the data came
from?

Suppose I have register globals turned ON, and I have a regular
old variable called "$bCreditCardAp proved = FALSE;".

By putting "?bCreditCardAp proved=TRUE" in the query string, I
might muck things up for your code logic.

**Jerry Stuckle** · Feb 7 '07, 06:15 PM

Re: global vars on/off

Rik wrote:

Jerry Stuckle <jstucklex@attg lobal.netwrote:
>

>Vincent Delporte wrote:

>>On Wed, 7 Feb 2007 11:24:23 +0200, "P Pulkkinen"
>><perttu.POIST ATAMA.pulkkinen @POISTATAMA.eli sanet.fiwrote:
>>>If you put register_global s = off, and use $_request, $_get, $_post
>>>and $_cookie, you'll surely know where your variables come from.
>> Why is it dangerous to use globals, and not know where the data came
>>from?

>>
>Well, as a simple example, let's say you put a value in your $_SESSION
>like:
>>
> $_SESSION('admi n') = 1;
>>
>This indicates the person has signed on and is authorized to access
>your admin screens. Now what happens if I do:
>>
> http://www.example.com/admin?admin=1
>>
>With register_global s on, I could access your admin screens even
>though I'm not signed on, because both could set the variable $admin
>to 1.

>
>
Indeed, allthough this is offcourse bad coding. Every variable should be
initialised, and every $_SESSION / $_POST / $_GET / $_COOKIE should be
accessed like such. So, when coding correctly, having register_global s
on is not a problem. However, when making a tiny mistake or when relying
in register_global s, that's where it goes wrong. In short, unless you're
infallable having register_global s off is just better.
--Rik Wasmus

Hi, Rik,

I didn't say it was *good* coding. But he did ask what the potential
problem was. :-)

And I've seen similar code way too many times, especially on sites built
for earlier versions of PHP.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

**Rik** · Feb 7 '07, 06:25 PM

Re: global vars on/off

Jerry Stuckle <jstucklex@attg lobal.netwrote:

> Indeed, allthough this is offcourse bad coding. Every variable should
>be initialised, and every $_SESSION / $_POST / $_GET / $_COOKIE should
>be accessed like such. So, when coding correctly, having
>register_globa ls on is not a problem. However, when making a tiny
>mistake or when relying in register_global s, that's where it goes
>wrong. In short, unless you're infallable having register_global s off
>is just better.

>
I didn't say it was *good* coding. But he did ask what the potential
problem was. :-)
>
And I've seen similar code way too many times, especially on sites built
for earlier versions of PHP.

I agree with you, it's just an illustration.
The programmer who thinks he's infallable should think again :P

--
Rik Wasmus

**Sonnich** · Feb 8 '07, 02:15 PM

Re: global vars on/off

Thank yuo all for your input, it has been useful.

I will also now take a look at $_SESSION in stead of having a ?
sessionid=, which is visile to the user.

S

**P Pulkkinen** · Feb 8 '07, 03:15 PM

Re: global vars on/off

"Sonnich" <sonnich.jensen @elektrobit.com kirjoitti
viestissä:11709 43606.930964.32 7430@s48g2000cw s.googlegroups. com...

Thank yuo all for your input, it has been useful.
>
I will also now take a look at $_SESSION in stead of having a ?
sessionid=, which is visile to the user.

Hello still!

I am "bothered" by the word "instead" here, so I want to make sure there's
not any misunderstandin g:

- You use $_SESSION to read and write session variables.

- You might see ?sessionid=2342 3423 automatically appear in your urls,
because that's how your php might be configured to maintain
sessions(sessio n.trans_id). Alternative to this is use of cookies:
session.use_coo kies

So instead of thinking "instead", just separetely enjoy $_SESSION itself
and if you want at the same time start to worry thing #2, do it. But don't
make it "instead" but "in addition to this"..

:-)

global vars on/off

global vars on/off

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment