Re: Conversion of period and space for $_GET, $_REQUEST, etc. is rather senseless

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, June 30, 2005 8:47 pm, Joe Krahn said:
> PHP imports GET and POST data to array elements by senselessly
> converting periods and spaces to underscore. The intent is to make
> strings variable-name compatible for conversion directly into global
> variables via import_request_variables or register_globals.

Honestly?...

Why in the world would you have variable names or even array keys with
such weird keys anyway, other than the imagemaps, of course?

[shrug]

> String-to-variable name mangling should only occur when being converted
> to variable names, but should be left as is when accessed as array
> elements. The current implementation is particularly bad because it
> mangles only periods and spaces, but leaves alone other special/unusual
> characters. Furthermore, the direct conversion into global name space is
> discouraged for security reasons.
>
> A feature-request was made related to this, but it was marked as "Won't
> Fix", primarily due to compatibility concerns. However, I think it's a
> poor design, and there must be some compatible way to move beyond this
> misfeature.

You'd break an awful lot of backwards-compatibility, for anybody actually
relying on it...

The biggest one being for INPUT TYPE="IMAGE" and image map ,x and ,y
variables.

If it weren't for those, I'd day go ahead and change it.  There probably
aren't THAT many users affected by anything else.

It would be nice if the original design had only mangled the variable
names and not the array keys, but changing it now...

Just too many applications are gonna get broken big-time.

> Do other people really want to keep the period/space name mangling for
> array keys, and not just for variable names? And, what happens when
> importing other special characters to variable names?

You could always get the RAW_POST_DATA and roll your own parser to
preserve/mangle things any way you like.

It would take you, what?, an hour of coding, including reasonable QA?

Yes, that's a "work-around" but it's not that ugly.

I'm not unsympathic to your plight, and you're absolutely right it would
have been a better Design had somebody thought to do it that way, oh, 10
years ago...

HEY!

Just noticed your email address...

Can you turn off that stupid auto-responder thingie from rr.com that keeps
spamming the list about viruses it deleted? Thanks. [I think it's rr.com,
right?...]

-- 
Like Music?
http://l-i-e.com/artists.htm

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux