Php won't pass varibles

Anon

I just installed slackware 8.1 and I am having problems with php 4.2.1 (or whatever the new one is) kind of a weird problem I make a program like this call login.php it's code is:

<?
echo "<form method = 'post' action = 'log.php'>";
echo "<input type = 'textbox' name = 'username'>";
echo "<input type = 'submit' value ='login'>";
?>

That's it then I have the log.php program it looks like this:

<?
echo $username;
print($password);
print("Connected");
?>

all I get is a Connected I never get a username no matter what I do. And another werid thing on login.php if at the end I wanted to add </form> it makes the page blank I can't see login.php at all. Please help me with this

fitzbean

You need to access form variables through the corresponding global array in the new version. I forget exactly what it's called - look it up.

sp0rk

Short answer: $_POST

Long answer: http://www.php.net/manual/en/language.variables.predefined.php

theslinky

You aren't the only person having this problem! Even I had it when i upgraded. Like the others said, these variables aren't global by default anymore.

There are two things you can do:

1) use the hashes $GET['varname'] and $POST['sds']. This is the best way (both coding wise and security wise)

2) But if you have a lot of programs using the old style (like I do), then turn on register_globals in the php.ini file.

The php.ini file is usually in /usr/local/lib. Copy it to that directory if you did a fresh install from the source distribution.

NOTE: I suggest you don't register_globals unless you want legacy support (that is if you have code using the old format). I read somewhere in the README that they are deprecating the register_globals in upcoming versions of PHP because of some security bug/exploit.

-sridhar

Anon

That and performance. The security hole is that users can cheerfully set bogus values for variables in your script simply by sticking them in the GET querystring, or with a minute fraction more work, as part of a POST request.

With register_globals turned on, you cannot trust any of the variables in your script that you don't explicitly set yourself. $_POST and its ilk allow you to keep values from the outside world under quarantine.