$_COOKIE, $_POST, etc....

Catfish

Ok, I am trying to make the move to register globals = off and of course none of my code works now. I am trying to understand from basic to advanced how to now pass variables throughout pages and cookies that are set. Is there any GOOD documentation in depth with examples on taking an HTML form and submitting the forms info to a page where error checking, DB inserting, and cookie setting is done without using register globals=on? Like is this ok.....

extract($_COOKIE);
if ($user == "" || $pass == "" || $sessionID == "" || $id == ""){ header("Location:crud.php");exit();}

or is that not ok?

I have noticed that if I do extract($_POST); at the top of my pages, I do not have to re-write hardly anything. Which is great, but I want to do it the right way, not the lazy way.

Can anyone help me out please?

shamly

I see no problem in the method you use.
The other method is not that difficult.

If you want to access a POST variable name 'name' all oyu have to do is

$_POST['name']

this will get you the value held by the post variable name.

same for the GET method

$_GET['name']

Hope this helps 🙂

Catfish

Thanks Shamly,

I tried the $POST and $GET but it only returned that value where I specified $POST. In the file, I error check, then insert into mysql, then set cookie, then redirect out. I would have to have 250 $POST entries next to every entry? Or is there a way to simply use the $_POST['variable'] throughout the page it is called on, and only calling it once? And if there is....whats the difference between register globals=on and posting my variables throughout the page? Thanks again.

jpmoriarty

well i think the truth of the matter is if you're referring to a post or get variable in your script, you should be using $POST['variable name'].if you wish, on that page, you can call it into a normal variable (ie $text = $POST['text']) or use the extract, but it's probably best to use extract() with EXTR_OVERWRITE to make sure you're using the posted (or got) variables.

I'm afraid i dont quite understand your questions though:

I would have to have 250 $POST entries next to every entry?

um, you should only use $POST once next to each entry - i think you mean you have 250 entries. is that even a question?

Or is there a way to simply use the $POST['variable'] throughout the page it is called on, and only calling it once?

i think you mean as in my eg above, $text = $POST['text'], but i could be wrong. You only have to "call" (it's not really being called though, i think it's being defined) that once.

whats the difference between register globals=on and posting my variables throughout the page?

if you mean what's the difference between $text and $_POST['text'], there isnt one - that's the point. The reason i think is that if you have register globals on, then there's nothing to stop people trying to "hijack" your variables in other pages. Now this might not be a problem, but maybe someone who's that way inclined could do something nasty with it, i dont know.

Catfish

Let me explain further.....

==============================================
include ("header.php");
include ("mysqlinfo.php");

if (strlen($POST['user']) <3 || strlen($POST['user']) >15){echo "oops"; exit();}

if (strlen($POST['password']) <6 || strlen($POST['password']) >15){echo "oops"; exit();}

if ($POST['password'] != $POST['password1']){echo "oops"; exit();}

yadda, yadda more error checking....

At this point, I start inserting values into the DB for updates, well the $_POST values above do not get inserted, the fields in the DB are blank for the values above.

Now when I had register globals=on, simply typing the variable $user on the page, the value was able to be used anywhere on that page.

Now, with register globals=off, anytime I need the data for $user on that 1 page, I type $POST['user'] throughout the script. Hence the 250 (little exageration) times I have to specifically type $POST['user'] on the same page.

So, other than typing $user = $_POST['user']; and every other value I am trying to pass at the top of every page I need it, is there another way? If so, then how do I continue passing the value on 2 or three pages in a row without setting the value as a cookie?

I hope this explains better, if not, then I must be wayyyyy off.

edwardsbc

Using extract() is the proper way around set globals being off. However, the point of turning off global registration is to remind you to check the varibles for validity. I always run my POST variables through filter function(s) like so:

foreach($_POST as $k=>$v) {
  $_POST[$k]=addslashes(safehtml($v));
}
extract($_POST);

And after that I usually do range checking on the numerics. Since all of my stuff is normally bound for a DB I use addslashes(), you may not need to.

BTW the safehtml() function I found in the code repository on this site. Nothing worse than allowing a user to insert < script > or < ?php tags into your site!

Catfish

Thanks Edward,

but I do not know what $k or $v is. Also how do I continue passing the value on 2 or three pages in a row without setting the value as a cookie? Sorry if this seems mute, but I want to understand this. Thanks

edwardsbc

Please lookup the [man]foreach()[/man] function in the manual for a full explanation. For now, just know that "foreach" walks the array element by element and you can retreive the current element key and element value with $k and $v (or any other variable name you put in the foreach construct).

If you need to pass all of these values to another page it can be done. I will assume a post example:

echo '<form name="myform" method="post" action="next.php">';
foreach($_POST as $k=>$v) {
  echo '<input type="hidden" name="'.$k.'" value="'.$v.'">';
}
# add submit and other form fields here...

It can be done with GETs as well, but is a bit more difficult to construct:

$gets='';$c=1;
foreach($_POST as $k=>$v) {
  if($c==1) { $gets.='?'; } else { $gets.='&amp;'; }
  $gets.=$k.'='.$v;
  $c++;
}
echo '<a href="next.php'.$gets.'">Next Page</a>';

shamly

Seems to me like you have only two options
1. to use extract
2. to use $_POST everywhere