How extract from POST!?

[leatherback]

Hi All,

After an earlier post, I wrote this snippet:

   if(!isset($_POST))
    {
      reset ($HTTP_POST_VARS);
      while (list ($key, $val) = each ($HTTP_POST_VARS)) 
      {}
    }
    else
    {
      reset ($_POST);
      while (list ($key, $val) = each ($_POST)) 
      {}
    }  

But it does not work. On one server (With an old PhP version, which dies not support $_POST) I get all the variables out just fine.

The new server just ignores the values. It does not recognice $HTTP_POST_VARS either. Only when I specifically define:

    $username = $_POST['username'];
    $password = $_POST['password'];

I can get the variables out. Am I making a big mistake? Anybody who can rewrite it a bit for me?
I would like to get all the variables from $_POST, without calling them individualy, since I have a lot of forms, with many entrie..

Thanks,

J.
J.

[laserlight]

The easiest way is
extract($_POST);

However, it would be better to actually use $_POST['username']

A slight note though:
$HTTP_POST_VARS is not autoglobal, unlike $POST
The same for all predefined arrays of the form
$HTTPVARS versus $

[leatherback]

Hahaha!!
Just that easy!

Wow, and I have been working on getting this since last night. Hm.. Feel a bit stupid now. Works like a charm.

But eeh..
- Why is it better to use $_POST['username'] ?
- What do you mean with: $HTTP_POST_VARS is not autoglobal?

Thanks.

J.

[laserlight]

Well, $POST['username'] surely comes from a form with the POST method, as opposed to $username, which could be a variable of your own, a variable from the query string, a cookie etc, assuming you do:
extract($REQUEST);

An superglobal variable (i.e. one that is autoglobal) has a global scope regardless of the code block.
For example,

<?php
function hello() {
	echo $_GET['hello'];
}
?>

will work to write the value of $hello from the querystring, but

<?php
function hello() {
	echo $HTTP_GET_VARS['hello'];
}
?>

will not.
you must use
global $HTTP_GET_VARS;
or
global $HTTP_GET_VARS['hello'];
in the function, first.

[leatherback]

Ah,

Thanks!

As for the use of $_post{''] compared to &:
All new variables I use, which are not from a form are set to 0 or "" before I use them.

Thanks for your help.

J.

[mcgruff]

Using extract($_POST) can create a variable substitution loophole.

A forged form could submit a var which you aren't expecting. If this has the same name as another (previously declared) var in the same script and in the same scope as the extract() line, it will overwrite it.

The safe way to do it is to add a prefix to extracted vars:

extract($_POST, EXTR_PREFIX_ALL, "prefix");