POST Value to Variable

kaleonard

I learned PHP as I was developing a very extensive script. When something worked on the development server, I assumed it worked and continued on. I learned late in the game that not all servers will pass posted form values to the php variable without using code such as:

$_POST['thevalue'] (in place of $thevalue)

or $thevalue = $_POST['thevalue']; (once at the beginning)

For me, $login and $password alone work fine, but some people who try my script on their server can't login unless they add:

$login = $POST['login'];
$password = $POST['password'];

at the top of the login processing script.

I know it was a rookie mistake, but I have to wonder (as I'm re-writing many files) why this happens on some servers and not others. I know POST data is carried in html headers & I have examined the result of phpinfo for some obvoius setting on my server, but it escapes me. Can anyone tell me why this happens on some servers and not others?

NogDog

There is a PHP configuration setting called [man]register_globals[/man]. When it is turned on, it creates the simply named variables from the $POST, $GET, and other super-globals. The problem is that as experience began to show that utilizing this convenience could lead to possible security problems and bugs in scripts, it was decided that it's not really a desirable feature, and as of PHP version 4.2.0 the default configuration has been to have it turned off. (Rumor is that PHP 6 will not have a register_globals option at all.)

Therefore, in order to maximize the portability and forwards-compatibility of your PHP scripts, you should never depend on this behavior. This means either simply referring to the applicable super-global array ($_POST, etc.) or populating more simply named variables from those arrays as needed/desired.

Besides, one advantage of using $_POST['name'] in your scripts (instead of $name) is that it is immediately obvious where that value came from when you are attempting to update or fix a script that you last worked on some time ago.

kaleonard

That makes sense. Thanks Dog. It does beg another question though. With register_globals off, does one also have to define every GET variable in the same way?

Man, I hope not!

bradgrafelman

kaleonard wrote:
With register_globals off, does one also have to define every GET variable in the same way?

Yup. Same with sesions, cookies, etc. This page lists these "superglobal arrays" as they're called: [man]variables.predefined[/man].

Really, though, they're much better than using register_globals. I mean, sure, you have to type a few more letters and an underscore - no big deal. But once you start using these globals instead, you can look at your code and instantly know where a variable is coming from. Before, you might see $name and wonder if a) it's something you've configured in the script, b) it's something that came from the user, or c) it's something you wanted configured in the script, but the user has altered it due to register_globals.