the-web-application-hackers-handbook

Chapter 19 n Finding Vulnerabilities in Source Code 725
Table 19-7: Variables Used to Acquire User-Supplied Data on the PHP Platform
VARIABLE
$_GET
$HTTP_GET_VARS
DESCRIPTION
Contains the parameters submitted in
the query string. These are accessed
by name. For example, in the following
URL:
https://wahh-app.com/search
.php?query=foo
the value of the query parameter is
accessed using:
$_GET[‘query’]
$_POST
$HTTP_POST_VARS
$_COOKIE
$HTTP_COOKIE_VARS
$_REQUEST
$_FILES
$HTTP_POST_FILES
$_SERVER[‘REQUEST_METHOD’]
$_SERVER[‘QUERY_STRING’]
$_SERVER[‘REQUEST_URI’]
$_SERVER[‘HTTP_ACCEPT’]
$_SERVER[‘HTTP_ACCEPT_CHARSET’]
$_SERVER[‘HTTP_ACCEPT_
ENCODING’]
$_SERVER[‘HTTP_ACCEPT_
LANGUAGE’]
$_SERVER[‘HTTP_CONNECTION’]
$_SERVER[‘HTTP_HOST’]
Contains the parameters submitted in
the request body.
Contains the cookies submitted in the
request.
Contains all the items in the $_GET, $_
POST, and $_COOKIE arrays.
Contains the files uploaded in the
request.
Contains the method used in the HTTP
request.
Contains the full query string submitted
in the request.
Contains the full URL contained in the
request.
Contains the contents of the HTTP
Accept header.
Contains the contents of the HTTP
Accept-charset header.
Contains the contents of the HTTP
Accept-encoding header.
Contains the contents of the HTTP
Accept-language header.
Contains the contents of the HTTP
Connection header.
Contains the contents of the HTTP Host
header.
Continued