Coding on PHP version 4.2.2

fabiuz

Hi,

I am upgrading to a new server with a new PHP version 4.2.2.
I am trying my old PHP code but I see that it is not working anymore.

Is there any difference between this version and previous ?

In particular I see that also a easy step like send variables trought a form is not working: variables values are not send to the new php page :-(

Could it be a problem related to the code or a missconfiguration on the new server ?

Thank you !

Fabi

claire

Check register_globals variable in your php.ini file - it should be set to on... If you can't modify your php.ini, label your variables $_POST or $HTTP_POST_VARS. This is new in PHP 4.x

fabiuz

Thank you !

It is set to off now...

I can modify php.ini ...is it a good solution or is it better to use new configuration of PHP 4.x ?

Thanks

claire

Modify your php.init setting so that your old scripts work, and use the new notation when you create new scripts!

morphy_6deex

btw write yr code using those arrays... it is a good way to get yr code a little more secure...

$POST["me"] it couldnt be called by my_script.php?me=1 it is $GET["me"]: another var another "environment"

fabiuz

Thank you for the answers !

I have only one doubt now:

When I send variables values using a link:

I can get the value in the next page by using $_GET['id']
Is this safe and the only solution ?

I maean, what if somebody changes the id valued in the browser for example ?

_GET will think that it is safe but it is not (I suppose) and so the situation is the same as with register_globals = on

I think there is another way tosend values between pages without using forms... but which is ?

If I have a listed number of records coming from a DB I can imagine only the situation to use something like <a href="test.php?id=3">
to let know to the program wich item I have click ... I am confused about.... help !

Thank again

Fabi

Weedpacket

Originally posted by fabiuz
...I maean, what if somebody changes the id valued in the browser for example ?

_GET will think that it is safe but it is not (I suppose) and so the situation is the same as with register_globals = on

Here's a general principle to follow:
NEVER trust data sent from the client.

No matter what little tricks you might come up with, ultimately you cannot control exactly what gets sent to the server from the client machine.

Be paranoid. Always check the validity and consistency of anything sent to you; always assume that the data might be corrupted in some way. If the user changes id=3 to id=4 or id=who%27s+a+pretty+boy+then then it's their own silly fault if they don't get the results for id=3.

If you don't want them to see id=4 for some reason, keep a session variable or database entry containing the fact, and then when they make a request, check to see if they're allowed to have what they asked for.

fabiuz

Yes, I agree...what I cannot understand is how to manage pages without using get...

Take this case: a list of names taken from a DB, I want that by clicking on a name it opens a new page with personal details of the person name that has received the click.

What I do now name by name is:

So I can tell wich details to get from database.

How can I remove ?idname=4 ?

Is it possible to remove ?

Thanks

Fabi

Weedpacket

Hrm; with a bit of javascript... wrapping the name in a span instead of an anchor, and giving it an onclick handler that sets a hidden form field and submits that form (the form having a POST method).

It's a kludge, though, circumvented without any trouble, only works if javascript is up and running, and only takes it out of the visible URL so it doesn't e.g., get bookmarked.

Is that the only reason why you don't want the number appearing in the URL? I mean, better obscuration can be done with more coding (by relying on data that is kept entirely on the server), but it may not be worth the hassle. Is there some restriction on which ids can be asked for by a given user? Only list the ids and names they're allowed to see, and check the ids that are requested against that same list.

morphy_6deex

mmm js is dangerous too... we DONT know if browser has it enable... he can skip r controls...

in fact the best way to check forms is, of course ehehe (thats my religion, my truth ehehe), server side...

if i was u ill leave the get params in the url... we can use get... but test it before use it!

k i get the $_GET["id"] = "maporkapupazza" and i expect an id as integer to query a db... well test it before the query... no problem just an handled error message.....

usually i do in that way:

<?
//includes
...
if("POST"==$_SERVER["REQUEST_METHOD"])
{
if(parse_form($_POST))
{
//handle form
//save post vars in session and header to another location
}
else
{
//handle error
}

//display form with self as action
?>