register_globals

yousaf931

hello,

I am having a problem with my hosting company as i send the variables through query string the variables isnt assicable on the other page. Because register_globals are OFF what will be the alternative.. I use $_REQUEST['var'] its works but the problem is that i have switch statement that assign values to the variable accordingly. And that variable are on the same page i included the file on the same page. And still they are not working.

Any one quide me please.

Thanks in advance.

sid

assign the value of the $REQUEST array (or $POST/$GET) to a variable right at the beginning of the page:

$var = $_REQUEST['var'];

that way you may use $var instead of $_REQUEST['var'] throughout the rest of your code...

apart from that: what exactly is it, that you can't accomplish with $_REQUEST['var']?

jcantrell

I had several scripts running on a server, and when they updated to a newer PHP version they turned off register_globals.

I like most people use a TON of variables that are being passed, and I didn't want to hand code them all:

$id = $HTTP_POST_VARS[id];
$name = $HTTP_POST_VARS[name];
etc. . .

SO I came up with this little ditty:

foreach($HTTP_POST_VARS as $i=>$v)
   {
        ${$i} = $v;
   }

Which loops through all of the HTTP_POST_VARS and sets the $var to $HTTP_POST_VARS[var].

Hope this helps.

sid

dirty deeds done pretty smart

Weedpacket

...although one could have just used [man]extract[/man]....

yousaf931

Thanks alot for your kind help 🙂

Weedpacket

Of course, using extract or the earlier code means you're eliminating at least two of the reasons (security and performance) for turning off register_globals in the first place. The security issue can be dealt with by only extracting those variables that should be extracted

$allowed_post_variables = array('foo', 'bar', 'baz');
foreach($allowed_post_variables as $variable)
  if(isset($_POST[$variable]))
    $$variable = $_POST[$variable];

...which also allows the possibility of including a default value in case the $_POST[] variable is empty (with an else clause). Then, one can extend that to do your form variable validation as well. And then you've got a pretty good approach to form variable handling 🙂