[RESOLVED] How? Prevent unwanted data sent to file

sherry

Hello.

Other than Post and Get and weak permissions, how can data be injected into a form script and used? In other words, if using a Post method, can unsetting the $GLOBALS Query string elements tighten up the security from remote users?

Thanks.

dagon

if your not using $GLOBALS, then unsettling wont achieve anything, you only have to worry about the variables you actully use

sherry

Thanks for your reply, dagon.

What if using a modified version of $GLOBALS for whatever reason, would removing the query string elements be enough to make using the modified $GLOBALS more secure?

Thanks.

dagon

please provide an example of what you are talking about.

sherry

Suppose...

$new_GLOBALS = $GLOBALS;
unset($GLOBALS[$HTTP_SERVER_VARS['QUERY_STRING']], $GLOBALS[$_SERVER['QUERY_STRING']], $GLOBALS[_GET]);

Will $new_GLOBALS be safe to use without the concern that vars could be injected via a query string?

Thanks.

dagon

its an exact copy, its more or less safe then the original

sherry

OOPS... :queasy:

I meant:

unset($new_GLOBALS[$HTTP_SERVER_VARS['QUERY_STRING']], $new_GLOBALS[$_SERVER['QUERY_STRING']], $new_GLOBALS[_GET]);

dagon

i still don't see the point of unsettling anything, the variable's mere existence is not a security issue

sherry

I was thinking of a scenario of a form being submitted remotely with a query string of vars added to the form's form action URL. Therefore, I figured, if the query string elements were immediately deleted, the vars could not be injected.

dagon

sherry;10974496 wrote:
I was thinking of a scenario of a form being submitted remotely with a query string of vars added to the form's form action URL. Therefore, I figured, if the query string elements were immediately deleted, the vars could not be injected.

Yes but it would do the exact same thing if the form was submitted legitimately. you seem to be looking for some magic one line fix for all possible attacks, it doesn't exist.

sherry

Not at all. Just looking to see if there is some way to use $GLOBALS safely so not having to add each variable one-by-one or create an array or object or define constants to a 'global' statement, etc.
(ref: http://www.phpbuilder.com/board/showthread.php?t=10378148)

Again, just a thought.

Thanks again, dagon

dagon

yeah, i wish i didn't have to do anything and php would know what i wanted, then again that's is what they pay me for. 😃

sherry

It's not about that either, dagon.

I was told about a solution that involved using 'extract($GLOBALS)'. Then later, I found in other threads not to use it because it was not secure. So, then I went looking for what could be done in order to use it since it is a neat PHP feature.

As I don't mind doing work, I do mind when I run across ways to do things more efficiently and don't take the time to explore those avenues. For example in this case, if PHP has a function to do certain things more efficiently, I feel no need to create my own function or use other steps to accomplish the same thing. This was that exploratory moment. 🙂

johanafm

The thing I see as being most pointless about unset($GLOBALS['GET']) is that you might as well just not use $GET or $GLOBALS['_GET']. Also, if you do unset it and still try to use it, you will have errors.
Moreover, if you one day actually wish to have a queryString, your old code would strip that information off.

If you really wish to strip anything inappropriate, you'd be better of removing exactly what should not be there

$ok_get_vars = array('name', 'date', 'stuff')
foreach ($_GET as $k => $v)
{
	if (!in_array($k, $ok_get_vars))
		unset($_GET[$k];
}

Then again, if you don't use extract or foreach over the array and use everything in it, but stick to the stuff that should be there in the first place, you wouldn't need to remove things that shouldn't be there either.

sherry

Thanks for the code, johanafm.

The unset for $GLOBALS was only for very specific cases, but I see your point.

I will mark this thread as 'Resolved.'

Thanks again.