Why use "extract" in this code?

schwim

Hi there everyone,

I'm playing around with some publicly posted anti-bot code, and found

if(phpversion() >= "4.2.0") {
	extract($_SERVER);
}

At the beginning of the script.

I checked on extract in the php man, and it seems to clear values(or overwrite them). What's the purpose of putting this at the start of the page?

It's a logging and reporting script that sends http referers/URI/User Agent to an email address and a dat file.

Is the function there to ensure old data doesn't get written to the file? Wouldn't the server automatically clear any values like this?

thanks,
json

halojoy

i do not often use extract

main reason would be to get 'shorter variable names'

This is one of the few times i have used extract. It is for an file upload script

If the form submitted file is 'file1'
instead of
$_FILES[ 'file1' ][ 'name' ]
you get
$name

After extraction, I can use this
echo "$name<br>";
echo "$type<br>";
echo "$size<br>";
echo "$temp<br>";

<?php

//Upload directory
$dir="upload/";

//Error messages
$code=array(
    0=>"There is no error, the file uploaded with success",
    1=>"The uploaded file exceeds the upload_max_filesize directive in php.ini",
    2=>"The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form",
    3=>"The uploaded file was only partially uploaded",
    4=>"No file was uploaded",
    6=>"Missing a temporary folder"
);

//Get posted upload data
foreach($_FILES AS $arr)
    extract($arr);
$temp=str_replace('\\','/',$tmp_name);

//Display
echo "<pre>";
echo "<h3>Uploading.</h3>";

if($error!=0){

echo $code[$error];
}
else{

echo "name    \t$name<br>";
echo "type    \t$type<br>";
echo "size    \t$size<br>";
//    echo "tmp_name\t$temp<br>";
    echo "<br>";
    $name=strtolower($name);
    if (is_file($dir.$name)){

    echo "<b>Already exists:</b>\t";
}
else{

    $r=move_uploaded_file($tmp_name,$dir.$name);
    if(false===$r)
        exit('some <b>move_uploaded_file</b> error');
    echo "<b>File stored:</b>\t";
}
echo $dir.$name;
}

echo "</pre>";

?>

schwim

Thanks for your reply halojoy,

here's the code in it entirety. Can you see the reason it would be used?

<?php

if(phpversion() >= "4.2.0") {
	extract($_SERVER);
}

echo("<html>
<head><title>Tag, you're it!</title></head>
<body>
<p>There is nothing here to see. So what are you doing here ?</p>
<p><a href='http://www.domain.com'>Go home.</a></p>");

$badbot = 0;
/* scan the blacklist.dat file for addresses of SPAM robots
to prevent filling it up with duplicates */
$filename = "./blacklist.dat";
$fp = fopen($filename, "r") or die ("Error opening file ... <br>\n");
while ($line = fgets($fp,255)) {
	$u = explode(" ",$line);
	if (ereg($u[0],$REMOTE_ADDR)) {$badbot++;}
}
fclose($fp);
if ($badbot == 0) { /* we just see a new bad bot not yet listed ! */
	/* send a mail to hostmaster */
	$tmestamp = time();
	$datum = date("Y-m-d (D) H:i:s",$tmestamp);
	$from = "badbot-watch@domain.com";
	$to = "me@domain.com";
	$subject = "script alert: bad robot";
	$msg = "A bad robot hit $REQUEST_URI $datum \n\n";
	$msg .= "address is $REMOTE_ADDR, agent is $HTTP_USER_AGENT\n";
	mail($to, $subject, $msg, "From: $from");

/* append bad bot address data to blacklist log file: */
$fp = fopen($filename,'a+');
fwrite($fp,"$REMOTE_ADDR - - [$datum] \"$REQUEST_METHOD $REQUEST_URI $SERVER_PROTOCOL\" $HTTP_REFERER $HTTP_USER_AGENT\n");
fclose($fp);
}

echo("</body>
</html>");

?>

I just can't figure out what purpose it serves.

thanks,
json

HalfaBee

if (ereg($u[0],$REMOTE_ADDR)) {$badbot++;}

is one line where it is used.
The $_SERVER['REMOTE_ADDR'] is extracted to $REMOTE_ADDR

schwim

Hi there halfabee,

Forgive my ignorance, but are you implying that he does that so he doesn't have to type as much at that location? Or is there another reason why it's necessary/desired?

thanks,
json

HalfaBee

That is exactly what I was implying.

schwim

Thanks very much for the clarification HalfaBee, I appreciate the help.

thanks,
json

halojoy

now there is another reason too

say I use 2 different pages with form file upload
using this same process handler

now this processer will work, whatever the input file is named
'file1' 'file2' or whatever

We can say my script is file input field name-neutral

Also this if I want to,
I can easily, with small changes, make this process page handle
multiple files uploading
does not matter how many.

foreach( $_FILES as $file_arr ) {

extract  $file_arr;

//handle the upload, $error, $name, $size, $tmp_name

} //loop for next file

Now, I am not as lazy, I can not write <?php
because I know there is a bigger chance my scripts will work at servers.

Can those smart???? guys using <?
tell me of the benefits of short tag
.. other than save your fingertips... some fractions of a precent % ?

Regards 🙂

schwim

Hi there halojoy,

thanks very much. I figured there had to be another reason for it, although come to find out, it's over my head 😃

thanks,
json

NogDog

schwim wrote:
Hi there halojoy,

thanks very much. I figured there had to be another reason for it, although come to find out, it's over my head 😃

thanks,
json

No, it's still the same reason: converting an array into a set of scalar variables. The only "benefit" is the saving of a few keystrokes by the coder when accessing those values. The downside is a little more memory usage (you're creating new variables in addition to the existing array) and possibly a few microseconds of processing time; plus you are obscuring the source of those variables, possibly making it harder to debug or modify the code at a later time.

In your original example, it looks like it probably is a case of an old script created back in the days when register_globals was turned on by default (pre PHP 4.2.0), or perhaps later but by someone who refuses to take the advice of the PHP developers in the warning at the top of this page, in particular:

Using the available PHP Reserved Predefined Variables, like the superglobal arrays, is preferred.

If a coder is going to use extract for this reason, rather than testing the PHP version, the if condition should be something like:

if(ini_get('register_globals')) {

schwim

If I wanted to remove that part, the only thing I would need to change would be

if (ereg($u[0],$REMOTE_ADDR)) {$badbot++;}

f (ereg($u[0],$_SERVER['REMOTE_ADDR'])) {$badbot++;}

correct? If so, that's the path I'd like to take.

thanks,
json

NogDog

There are a number of lines toward the bottom of the code sample you supplied that appear to use variables from that extract: basically any of the variable names you see that are in all upper-case letters.

schwim

Thanks very much nogdog, I've changed them as well.

thanks,
json