is there a setting to pass variables easier?

Druid

I recently upgraded php versions and most of my scripts are done as follows:

1) <input type="text" name="username">
2) obtain the username with $username

1) URL = http://example.com/index.php?userid=57
2) obtain userid via $userid

Now, I must use use $POST['username'] and $GET['userid'], is there an option to enable easier access to those variables? Or was it changed for a security reason?

leatherback

It was changed for a security reason: Anybody could change any variable in yor scrpt by guessing the name (say.. loggedin, query, ...) and easily take control.

There are easy ways, but they just open the gates again.

For security:
=> Leave register_globals() on
=> ALways program in a way that you know that the input is safe (check numbers for being numbers, strip characters you do not want, and make sure slashes are added to user-inputted text

rmbarnes82

One option is to use the extract function.

http://uk.php.net/manual/en/function.extract.php

If the $POST array looks like this
code=php[/code] then doing

extract($_POST)

would create 2 variabes, $name with a value of 'robin' and $id with a value of 12.

I don't like this approach though, there could be secuirty vunrabilites.

To save typing $POST all the time you could create a reference to $POST and use it as a shortcut:

$v = &$_POST

Now $v and $_POST are effectively the same variable, changes made to one will effect the other and you could use

$v['name']

to get the value 'robin'.

NogDog

In the long run, it's probably just best to use the applicable super-global variable. Besides maximizing the portability of your scripts, it makes maintaining them easier: when you see a variable named $_POST['name'] you know right away where that variable came from, whereas $name is much less specific. Sure, it's a little bit more typing initially, but over the life of a script that time is microscopic compared to the time you might spend debugging and maintaining it.

Weedpacket

rmbarnes82 wrote:
I don't like this approach though, there could be secuirty vunrabilites.

The [man]extract[/man] page specifically mentions that this is a bad idea.

ClarkF1

leatherback wrote:
For security:
=> Leave register_globals() on

I think that should be "off" not "on"

leatherback

ClarkF1 wrote:
I think that should be "off" not "on"

Sh*t. Ah well. It was late..
😃
:quiet:

scrupul0us

Weedpacket wrote:
The [man]extract[/man] page specifically mentions that this is a bad idea.

i feel as if ive mentioned that at least 3-4 times in the past two months

people dont understand that simplicity can compromise security