$ var instead of $ _GET ['var'] in PHP?

Question

Ok, I can't remember the details of this, but on some servers you can use

$ var instead of $ _ GET ['var'] to access the variable in the url, I know it is BAD, but I can’t remember why it is Bad?

Answer 1

I think you mean Register Globals .

You should not use them because you cannot distinguish the source of these variable values, since they can come from any source of EGPCS variables (Environment, GET, POST, Cookie, Server).

, $var, , $_ENV['var'], $_GET['var'], $_POST['var'], $_COOKIE['var'] $_SERVER['var'].

Answer 2

Register Globals . . ; :

<?php
// define $authorized = true only if user is authenticated
if (authenticated_user()) {
    $authorized = true;
}

// Because we didn't first initialize $authorized as false, this might be
// defined through register_globals, like from GET auth.php?authorized=1
// So, anyone can be seen as authenticated!
if ($authorized) {
    include "/highly/sensitive/data.php";
}
?>

Answer 3

, register_globals 1 ( true) php.ini.

- , , , .

php.ini .

Answer 4

, , PHP . , . , $_GET , .

Answer 5

. - , , . isset, , .

Answer 6

, , , , (-, PHP ), , /myapp/index.php?admin_privileges=1.

Answer 7

REGISTER_GLOBALS, :

REGISTER_GLOBALS ?

Answer 8

, "register_globals" . , , , , URL. : http://www.php.net/manual/en/security.globals.php

Answer 9

$_POST, $_GET .., , .

Answer 10

, PHP. , , .

You can use extract () for more controlled behavior. It will extract the keys from the array (in this case, $ _GET) into the local context as variables. You can give them a common prefix so that they do not interfere with your existing variables. And you can pre-filter the array to make sure you get the expected variables.

int extract( $var_array [, $type = EXTR_OVERWRITE [, $prefix  ]] )

Import variables from the array into the current character table.