Re: Re: setcookie security concerns [medium]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



	(Comments inline)

tedd wrote:
[···]
From what I've read (PHP Cookbook by Sklar and other sources) the reason why you don't want to use $_REQUEST is because it holds all the variables from six global arrays, namely $_GET, $_POST, $_FILES, $_COOKIE, $_SERVER, and $_ENV.

Actually, the super-global variables used in $_REQUEST are $_GET, $_POST and $_COOKIE¹, and though there is a "gpc" directive I'm not sure if you can control the order they are read (but my guess would be that you do)
¹http://php.net/manual/en/reserved.variables.php#reserved.variables.request

When PHP creates $_REQUEST, it does so by adding the global arrays together in a certain order, namely EGPCS. Normally, this would be OK, but if two (or more) of those arrays have a key with the same name, then that key value will be replaced with the last value read. For example, the value provided by $_GET('mykey') will be replaced by the value found in $_COOKIE ('mykey') in generating the value for $_REQUEST('mykey').

So, if you use $_REQUEST, then you can't reply upon where its values are derived.

Well, I still don't remember the reason, but this could be a valid one :) By the way, these are variables (arrays), so you should use square-brackets instead of parenthesis to specify an index (e.g. $_SERVER['SCRIPT_NAME'])
--
Atentamente,
J. Rafael Salazar Magaña
Innox - Innovación Inteligente
Tel: +52 (33) 3615 5348 ext. 205 / 01 800 2-SOFTWARE
http://www.innox.com.mx

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux