I can´t receive values on the server

eloy

I have running php+mysql+pws on Windows 98 but i have a problem.

When I send values in a Form variables to a php script, it can´t resolv this values, which means, the variables are empty when arrive.

What can I do for resolve that problem.

I need take that values for INSERT into a table.

🙁

this is part of the script that send values*******************

<FORM METHOD=POST ACTION="procesar2.php">
<TABLE>
<TR>
<TD>Nombre:</TD>
<TD><INPUT TYPE="text" NAME="nomb" SIZE="20" MAXLENGTH="30"></TD>
</TR>
<TR>
<TD>Apellidos:</TD>
<TD><INPUT TYPE="text" NAME="apell" SIZE="20" MAXLENGTH="30"></TD>
</TR>
</TABLE>
<INPUT TYPE="submit" NAME="accion" VALUE="Grabar">
</FORM>

When send values, this, are showed in the address bar of the browser which means that this are sended but not received.

Example:

http://localhost/procesar.php?nomb=john&apell=White

nomb and apell are VARCHAR.

this is the script that receive********************

<?php
if (!($link=mysql_connect("localhost","root","2948em")))
{
echo "Error conectando a la base de datos.";
exit();
}
if (!mysql_select_db("prueba",$link))
{
echo "Error seleccionando la base de datos.";
exit();
}

mysql_query("insert into prueba (Nombre,Apellido) values
('$nomb','$apell')",$link);

echo "EL nombre es : $nomb" . " y el apellido es : $apell";

/the output is El nombre es: y el apellido es :/

?>

my table´s name is prueba and fields are "Nombre" and "Apellido". the variables received are $nomb and $apell.

¿What happen?

Wave

you must to set "register_globals = on" in your php.ini file if you want use global variables for received vars.

or you can use $HTTP_POST_VARS array instead

f.e. $HTTP_POST_VARS['nomb'] instead of $nomb

[deleted]

Or if you are using HP 4.1 or better, just use $_POST['fieldname']

as of PHP 4.1 the $GET $POST, $SESSION and $COOKIE are superglobal, they are available everywhere in your script.

Leave register_globals off because it is a security risk!

Wave

heh... Win98 is much more security risc >🙂
register globals is secure, if you always declare your variables before use.

[deleted]

"register globals is secure, if you always declare your variables before use."

How can you declare a POST or GET var without overwriting the value that was sent through the POST or GET operation?

You use register_globals to have PHP automatically declare any incoming vars as globals for you. But PHP doesn't care where the vars came from, session, cookie, post and get vars all get registered as globals in your script.

And once they are global, there's no way of knowing where they came from.

And if you don't know where they came from, there's nothing you can do about them, they could be proper vars from a session, or hacked vars from a COOKIE, POST or GET operation, you cannot tell, so you cannot check the vars for illegal content.

Luckily PHP registers the vars so that sessions allways overwrite POST/GET and COOKIE, but if you forgot to set the var in the session, a hacker can set the var through the URL and mark himself as logged on.

The bottom line is that PHP changed the default register_globals setting to 'off', and it affected a huge number of scripts. They would not do something like that if they did not have a very good reason for it. And as any junior programmer knows, globals are evil, and in this case they are super-evil.

Wave

How can you declare a POST or GET var without overwriting the value that was sent through the POST or GET operation?

i mean declare variables, wich haven't pass via POST or GET...

You use register_globals to have PHP automatically declare any incoming vars as globals for you. But PHP doesn't care where the vars came from, session, cookie, post and get vars all get registered as globals in your script.

And once they are global, there's no way of knowing where they came from.

we can check it, if it necessary. just check is variable with this name in appropriate array.

And if you don't know where they came from, there's nothing you can do about them, they could be proper vars from a session, or hacked vars from a COOKIE, POST or GET operation, you cannot tell, so you cannot check the vars for illegal content.

i can.

Luckily PHP registers the vars so that sessions allways overwrite POST/GET and COOKIE, but if you forgot to set the var in the session, a hacker can set the var through the URL and mark himself as logged on.

if it happens, it will be my fault, not PHP.

The bottom line is that PHP changed the default register_globals setting to 'off', and it affected a huge number of scripts. They would not do something like that if they did not have a very good reason for it.

i suppose the reason is huge number of peoples, with bad coding style. afaik PHP position is "programming language for all", isn't it?

And as any junior programmer knows, globals are evil, and in this case they are super-evil.

yes, they are devil... for any junior prorammer 😃

Regards, Dan.