Programming PHP

These directives ensure that PHP error messages are never shown directly on your
web pages. Instead, they are logged to the specified file.
Set variables_order
The default PHP configuration automatically creates global variables from the environment,
cookies, server information, and GET and POST parameters.The
variables_order directive in php.ini controls the order and presence of these variables.The
default value is "EGPCS", meaning that first the environment is turned into
global variables, then GET parameters, then POST parameters, then cookies, then
server information.
Allowing GET requests, POST requests, and cookies from the browser to create arbitrary
global variables in your program is dangerous.A reasonable security precaution
is to set variables_order to "ES":
variables_order = "ES"
You can access form parameters and cookie values via the $_REQUEST, $_GET, $_POST,
and $_COOKIE arrays, as we discussed in Chapter 7.
For maximum safety, you can disable register_globals in your php.ini file to prevent
any global variables from being created.However, changing register_globals
or variables_order will break scripts that were written with the expectation that
form parameters would be accessible as global variables.To fix this problem, add a
section at the start of your code to copy the parameters into regular global variables:
$name = $_REQUEST['name'];
$age = $_REQUEST['age'];
// ... and so on for all incoming form parameters
Filenames
It’s fairly easy to construct a filename that refers to something other than what you
intended.For example, say you have a $username variable that contains the name the
user wants to be called, which the user has specified through a form field.Now let’s
say you want to store a welcome message for each user in the directory /usr/local/lib/
greetings, so that you can output the message any time the user logs into your application.
The code to print the current user’s greeting is:
This seems harmless enough, but what if the user chose the username "../../../../
etc/passwd"? The code to include the greeting now includes /etc/passwd instead.Relative
paths are a common trick used by hackers against unsuspecting scripts.
Another trap for the unwary programmer lies in the way that, by default, PHP can
open remote files with the same functions that open local files.The fopen( ) function
and anything that uses it (e.g., include( ) and require( )) can be passed an
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.
Filenames | 287