Foreach $_POST question

4rxsid

Hi all,

I've got global vars turned off, using php 4.3.10 loaded on a windows 2003 server running apache 2.0.52.

Before php 4.3, I used to be able to reference submitted vars with just $var1, $var2, etc. Now, of course, I need to use something like $POST['var1'], $POST['var2'], etc.

I need to get the data submitted from about 20+ different vars, and use/manipulate all those many different times within a script.

How can I "convert" the $POST['var1'] to just $var1 so that I don't need to keep using $POST['var1'] every place i need it?

I want to do something "clean" like this:

foreach ($_POST['vararray']) {
    $var = $_POST['vararray'];
}

Sorry if this isn't worded correctly, I'm hoping someone understands what I'm trying to accomplish here. I just can seem to get the syntax correct.
Any help would be greatly appreciated.

Thanks.

devinemke

extract($_POST);

4rxsid

thanks for the reply devinemke. that's just what i was looking for.

on php.net they list this as being second to last (right before $GET) as for order of preference. they list $SERVER first, but of course that will return many other vars that are not found on a form submitted, so this isn't as effecient for me as using $_POST.

are there significant "security" concerns using extract($_POST)?

devinemke

Originally posted by 4rxsid
are there significant "security" concerns using extract($_POST)?

yes, the exact same security concerns of having register_globals turned ON. essentially that's what register_globals is doing, automatiically running [man]extract[/man] on all the super-global arrays

4rxsid

but with global vars turned on...doesn't that concern the data being sent from the client to the server...whereas the extract() function deals with the data after it's already on the server?

devinemke

Originally posted by 4rxsid
but with global vars turned on...doesn't that concern the data being sent from the client to the server...whereas the extract() function deals with the data after it's already on the server?

but what you are extracting is the $_POST array which contains data sent from the client.

bradgrafelman

I know I'll sound like a noob asking this, but:

What EXACTLY is the security threat/vunerability/issue with the behavior of register_globals, extract, etc.? Are we worried about malicious data being sent? Can't that easily be solved using a quick call to addslashes(), MySQL's escape function, etc.?

Is there something else?

ahundiak

The security threat with register globals on is that users can submit values by typing in the url. They come in via $_GET but you don't know that. There are several articles on this.

It's not really much of a threat since you should always check your inputs regardless of the source.

Drakla

I've heard loads of people say that addslashes thing, but how exactly would that work?

there's also [man]import_request_variables[/man] which will shove them into the global scope - extra does it into the scope in which it's called.

I do something similar (well used to) when getting input

$fields = array('name', 'surname','address', 'email');

foreach($fields as $field)
{
    $$field = trim($_POST[$field]);  //create them vars
}

Same with escaping the damn lot when inserting them into a db.

bradgrafelman

The obvious answer would be to prefix all imported variables, i.e. $var1 becomes $post_var1, but that's redudantly redudant since $_POST['var1'] gets you there.

I had thought about this after posting. Thanks!

So, obviously, the best solution to a production type environment is to turn OFF register_globals, and use the code:

<?PHP
if (!get_magic_quotes_gpc()) {
   $lastname = addslashes($_POST['lastname']);
   $fistname = addslashes($_POST['firstname']);
} else {
   $lastname = $_POST['lastname'];
   $fistname = $_POST['firstname'];
}

You learn something new every day! :p

(For those confused on my code example, look at [man]get_magic_quotes_gpc/man and what [man]addslashes/man does)

4rxsid

thanks for all the info guys...for now, I'm going with:

foreach($_POST as $key=>$value) {
  $$key=$value;
}

devinemke

Originally posted by 4rxsid
thanks for all the info guys...for now, I'm going with:
foreach($_POST as $key=>$value) {
  $$key=$value;
}
[/B]

...which acheives the exact same effect of doing:

extract($_POST);

hate to sound like a broken record but if you want to create global variables from the POST array then just use [man]extract[/man]. it does the same thing as your snippet above with less code.

4rxsid

hmmm...yeah. not sure why i'm insisting on making this more difficult than needed. haha. i'm all about keeping code simple if possible, for many reasons.

i'll go with extract() and just live with it. my environment (intranet) doesn't need to be 100% locked down anyway. i just need to prove to the power structure that is within my company (120 k employees) that an "open source" solution which includes php, can be as effective, stable & secure, or more so, than our current $icrosoft/asp solutions.

thanks again.