parse_str() and register_globals

linus

Lately I've become aware that not all servers have register_globals on and have been trying to make do without it. Everything's ok so far, except this. To avoid using ampersands in my query strings, I use semicolons instead. Then I use parse_str() to convert the query string and read the vars properly:

parse_str(str_replace(';', '&', getenv('QUERY_STRING')));

But I just noticed that parse_str only affects the global variables, it doesn't affect the contents of arrays like $HTTP_GET_VARS. Any suggestions?

One possibility I've thought of is that parse_str() sets the global variables regardless of the setting of register_globals, in which case one could just always use parse_str and forget about the whole register_globals issue entirely. 🙂

Anon

parse_str() essentially just extracts out variables from a string that follows querystring syntax (name1=value1&name2=value2 etc...). With regsiter_globals off you can accomplish the same thing by doing:

extract ($_GET);

if you must use parse_str(), you can give an optional argument to store the variables in an array:

$string = 'name1=value1&name2=value2';
parse_str ($string, $array);

$array now has:
'name1' => 'value1'
'name2' => 'value2'

linus

Yeah, I just learned about the array thing. 🙂 However, using parse_str() appears to put all the variables in the global scope, no matter what the setting of register_globals (I just tried it with register_globals off).

Also, what's this $POST and $GET stuff I've been seeing? Are those arrays just the same as $HTTP_POST_VARS and $HTTP_GET_VARS, and are they always available?

Anon

parse_str doesn't have anything to do with register_globals. If register_globals is on, PHP calls parse_str (or a similar function) on the query string. So register_globals in dependent on parse_str. But not the other way around. parse_str is just a generic function - doesn't matter how PHP is installed or anything.

$POST And $GET (and $SERVER, $ENV and $COOKIES) serve the same function as $HTTP_SOMETHING_VARS, but they only exist after version 4.1.0. Another difference is that they are superglobals. For example, before 4.1.0, in a function you'd have to say:
global $HTTP_POST_VARS;
to be able to use it...but now you don't need to do
global $POST;
because it is a superglobal so it exists everywhere. For more info about this, read the releace announcements for PHP4.1.0

Diego