Security?

Anon

I was wondering if the feature in php that assigns variables being passed to a script is very secure to use, or should I turn it off and use HTTP_POST_VARS[blah] instead...

Cheers Sam

yanyan

it depends on the data you are passing.. if you think that is very important that you will not let anyone see it then use HTTP_POST_VARS but if not then just pass it.

PS. Trying using SESSIONS.

Good Luck
Brian

Anon

The automatic variable feature just determines whether GET/POST variables are automatically established as global variables in PHP, or whether you have to retrieve them from the HTTP_nnnn_VARS arrays. Either way, the user can see them in the URL (with GET) or by inspecting the html source (with POST).

As Brian says, sessions are a great way to store data between scripts, but even so you can't really hide the data being passed between the browser and the script (obviously!)

Anon

I don't think you understood my question. I know the benifits of sessions and about the holes in passing via POST or GET. What I was asking was about turning of the feature that automaticly sets passed variables as globals. Say if I want to use a veariable in my script called $IS_LOGGED_IN but I don't want to have to check to see that the user could not have assigned some crazy value to it with a post or a get... I guess this doesn't matted anyway because I have to give it a value anyway...

Never mind Guys.
Cheers Sam 🙂

yanyan

Yes that's true... if you want to atleast give security so you just have to customized everything from you code to your browser to you server etc..

Cheers :->
Brian