Your book was written during a kinder and gentler time.
A little history might be in order.
Originally PHP was designed to work very easily with variables whether submitted in forms (via POST) or through URLs (either with a form GET method, or simply by putting the vars in a URL string.
Suppose you wrote a program where the author of a bulletin board message could delete the message s/he wrote.
First you might do something like this:
<? $result=mysql_query("SELECT messageid FROM messagetable where authorid=123");
$row=mysql_fetch_array($result);
$messageid=$row[0];
//then you could create a form for author with id 123:
echo "
<form method=post action=deleterecord.php>
<input type=hidden name=messageid value=$messageid>
Delete record $messageid?
<input type=submit name=delete value='DELETE'>
</form>
";
The author (with id 123) would see a form that said:
Delete record 222?
-Button-DELETE
If the author were to click the button, and PHP would pick up the variables from the form. deleterecord.php might be:
<? if($delete) {mysql_query("DELETE FROM messagetable WHERE messageid=$messageid");
echo "message $messageid was deleted"; } ?>
That code would check if the variable named 'delete' existed -- as it would be if the submit button were clicked.
The code would then use the hidden messageid variable embedded in the form and delete the user's message.
This is pretty simple code.
Your book reflects this approach. With "register globals" on, PHP captures and populates any named variables shown in the submitted form.
Somebody figured out that they could hand-craft a URL like this:
http://somesite.com/deleterecord.php?recordid=111&delete=true
The variables in this URL -- GET variables -- would automatically be defined and populated by PHP.
While the form might have been meant to delete only a specific message that the user wrote, the URL above creates a simlar set of data, without any regard to controlling access.
This presents opportunity for mischief.
$_POST (which replaced $HTTP_POST_VARS, thank god) gets around this problem.
$_POST is an array that shows variables resulting from a form's POST method.
Each named element in the array $_POST contains the value of the variable named in the form.
Change the code to:
<?
$delete=$_POST['delete'];
$messageid=$_POST['messageid'];
if($delete) {mysql_query("DELETE FROM messagetable WHERE messageid=$messageid");
echo "message $messageid was deleted"; }
?>
Because it works on POST variables (not the GET variables of a URL, the will now work only the variables ASSIGNED TO THE FORM BY THE PROGRAMMER (remember that 'SELECT messageid...' query that populated the form?).
Another thing:
$_POST is a global variable. That means you can access its content within any function.
for example you could turn the delete code into a function like this:
function deletemessage(){
$delete=$_POST['delete'];
$messageid=$_POST['messageid'];
if($delete) {mysql_query("DELETE FROM messagetable WHERE messageid=$messageid");
return true;
}
else
{
return false;
}
}
and change deleterecord.php to
if(deletemessage()){echo "message $messageid was deleted";}
Since $_POST is always globally available, you wouldn't need to worry about passing parameters to this function, or predeclaring certain variables as globals. A minor benefit, to be sure, but occasionally very useful.
There are several global arrays similar to $POST: $GET, $COOKIE, $SERVER. You should look them up.
Good luck.
My wireless was being a pain and wouldn't load up the board when I fixed it.