$_get

drag0n

How does the $_GET[" "] make websites more secure?

diego25

It doesn't allow the user (the one with the browser) set whatever variables they please. For example, if you had this:

<?
$built_in_password = "mypass";

// $password comes from a form
if ($password == $built_in_password) {
  $loggedin = true;
}

if ($loggedin) {
  print "Hey, this is very secret! don't tell anyone!";
}
?>

So, if you have register_globals on, someone could call your script like so:

script.php?loggedin=1

So now in your script $loggedin would be defined as 1, and so it will bypass the password checking and it will print the sensitive info!

In other words, it's not that $_GET[] makes your apps more secure. The problems lies with register_globals. But if the PHP developers remove register_globals (or turn it off by default), then they have to introduce some other way for you, the web app developer, to access GET, POST, etc, variables.

Diego

drag0n

thanks, i understand about that now. The example u made was with the $POST function right? Thanks
so is there a difference between $GET and $POST? Im probably confusing you guys, but im confused myself, lol =)! So if i was trying to make a variable get stuff from the url, and I had register globals on, I would have to do:
$get = get
? is that correct? say i want the variable to get the "page=" in the url, like so: http://blah.com/switch.php?get=blah
So what happens if I add the $GET tag to it? I mean, i would still be able to type everything into the query string.
Wow, i just re read that and its really confusing so who ever can help me, thank you!

diego25

It'd be

$get = $_GET['get'];

By using $GET and $POST, you make sure that the data is coming from where it's supposed to come from. For example, if you have register_globals on and used $id in your script, where is that coming from? Cookie, environment, query string, form, etc? Therefore, by using $_GET['id'], you make sure that the id is coming from where you want it to come from.

Diego

leetcrew

you may use md5

 

string md5(string);