Path: csiph.com!2.eu.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!news.albasani.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: Thomas 'PointedEars' Lahn Newsgroups: comp.lang.php Subject: Re: PHP processing steps to apply to a URL to make it safe Date: Sat, 20 Feb 2016 23:48:58 +0100 Organization: PointedEars Software (PES) Lines: 50 Message-ID: <4923957.ITEB7SZ2Lq@PointedEars.de> References: <28000155.9IakGmh2Vy@PointedEars.de> <1703763.CG5OWGaxa9@PointedEars.de> <2319797.8AR7HHlkXX@PointedEars.de> Reply-To: Thomas 'PointedEars' Lahn Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8Bit X-Trace: solani.org 1456008538 2646 eJwNxMkBwCAIBMCWFlyIlsNl/yXEeYwtF6+Pbk67dqWCsyYTdiJbt1cnEEU9+8l+kVSgRQY/KvYQ8Q== (20 Feb 2016 22:48:58 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Sat, 20 Feb 2016 22:48:58 +0000 (UTC) User-Agent: KNode/4.14.2 X-User-ID: eJwNyMkRwDAIBLCWOBdTDgHcfwnx6CdXMDoMDvP7sPWWBh0gVtOyqEF1e9sQfXLTiWtrmOJVz6SIjn+hWfIDSzEVZg== Cancel-Lock: sha1:gia0E2grmRyTcQ3PdZWRvxASCsY= X-NNTP-Posting-Host: eJwFwYEBwCAIA7CXhNKC50yR/09YQsh0M0QFh4PeQt3GPbSNHp/36XVLO+qh3LGWHZDpq/IHIAAQfA== Xref: csiph.com comp.lang.php:16549 James Harris wrote: > […] Let me give an example with this URL > > http://example.com/folder/file?greet=hello;lang=en#top > > If that was presented to the server I would need to see the following > string > > /folder/file?greet=hello&lang=en You would not, unless either a) the used index file of the document root, b) “folder”, or c) “folder/file” were PHP programs, and as for the latter two you had enabled content negotiation. But then, either a) $_SERVER['PATH_INFO'] === '/folder/file', b) $_SERVER['PATH_INFO'] === '/file', or c) you had found the file already. Because you would not rewrite *every* request to the same PHP program, would you? > In my PHP code I would report that as invalid because the query string > is unacceptable. > > I need to see the query string so that I can report a request containing > one as invalid. […] Again, why? If you are only interested in the path, what does it matter if there is also a query _part_? And if you are using $_SERVER['PATH_INFO'] for mapping, if you must exclude the case that people also specified a query part you can still test for $_SERVER['QUERY_STRING'] or a set and non-empty $_GET array. Although it can be done, I can still see no reason to sanitize $_SERVER['REQUEST_URI']. > BTW, is there a $_SERVER element that would return the #top part as well? No, as that is not a part of the *request* URI. -- PointedEars Zend Certified PHP Engineer | Twitter: @PointedEars2 Please do not cc me. / Bitte keine Kopien per E-Mail.a