On 02/22/2010 10:37 PM, Michael Shadle wrote:
On Mon, Feb 22, 2010 at 1:30 PM, David Murphy<david@xxxxxxxxxxxxxxxxx> wrote:
Richard,
The use of $_REQUEST it no more a security hole than $_GET or $_REQUEST,
they should ALL be treats as bad data until normalized and sanitized. The
claim that it opens a security hole is just false, that’s like saying PHP
is insecure, its not it just allows for lazy coding such as $_REQUEST.
It represents a way for people to exploit coders who don't know any better.
Expecting a cookie value to come through in $_REQUEST but you could
override using a query string parameter makes for easy exploitation.
And how is this more secure? I can create a cookie, send post or get on
my client machine and send anything I want to the server. Just because
you are getting a cookie does not mean that you created it :)
So you might as well use request because the data can not be trusted
either way.
--
John
Gerechtigkeit entspringt dem Neid; denn ihr oberster Grundsatz ist:
Allen das Gleiche.
[Walther Rathenau]
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
