[RESOLVED] extract($GLOBALS); ??

trevorsg

Hey guys,

I want to create a function that includes a file based on the argument of the function. The included file will need to include global variables. Is it permissible to use

extract($GLOBALS);

or is this some kind of security risk?

Thanks,
Trevor

Weedpacket

You mean you don't know which global variables you want to use? If you do, just use them. And why not pass those values to the function in the normal way?

trevorsg

No, since I'm including a file based on the parameter to the function, I really don't know which variables I will need. This is also the reason I can't pass these values into the function "the normal way".

Maybe there's a better way to do what I want to do. My function is called element(), which works similar to CakePHP's element include function, and simply includes a view template file based on the argument to the function. The view template files can use a wide range of global variables.

Thank you for your help.

NogDog

My first response is that if you find a need to do such a thing, it's probably an indication that there is some aspect of the application design that could be improved so that it's not necessary.

That being said, the security issue would be essentially the same as with register_globals: if the extract() creates a variable which the following code uses in an uninitialized manner, then there is a potential for that variable starting out with a problematic value. Well-written code that never uses uninitialized variables will not have this problem.

trevorsg

NogDog;10903113 wrote:
My first response is that if you find a need to do such a thing, it's probably an indication that there is some aspect of the application design that could be improved so that it's not necessary.

That being said, the security issue would be essentially the same as with register_globals: if the extract() creates a variable which the following code uses in an uninitialized manner, then there is a potential for that variable starting out with a problematic value. Well-written code that never uses uninitialized variables will not have this problem.

Thanks for your response. I have thought about this problem, but I can't find a more elegant solution than the one I already use. I tend to think that I write clean and efficient code, and I certainly don't use uninitialized variables (I come from a Java background, see). I do all of my development with all error and notice reporting on.

NogDog

It probably won't be a security issue then. It could become a maintenance/testing issue in much the way any use of globals can, so you just have to balance that with all the other risk assessment factors and go with whatever you think is best.