Path: csiph.com!usenet.pasdenom.info!nntpfeed.proxad.net!proxad.net!feeder1-2.proxad.net!137.226.75.22.MISMATCH!newsfeed.fsmpi.rwth-aachen.de!newsfeed.straub-nv.de!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Matthew Carter Newsgroups: comp.lang.php Subject: Re: PHP Global Variable Usage - Possible? Date: Mon, 27 Jul 2015 20:59:35 -0400 Organization: Ahungry (http://ahungry.com) Lines: 42 Message-ID: <87pp3d5c7c.fsf@ahungry.com> References: <87k2tmcr65.fsf@ahungry.com> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: mx02.eternal-september.org; posting-host="7c986cd4736462de309a749b207746fe"; logging-data="7382"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18iI+SkN0Qi3BKhS20UZ6KV" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) Cancel-Lock: sha1:5dr30l+5nk8jLhBZ/neXT6z6YUw= sha1:8+Cm1B4GGxaWMppVBiVzjyuLntw= Xref: csiph.com comp.lang.php:15616 Denis McMahon writes: > On Sun, 26 Jul 2015 21:42:10 -0400, Matthew Carter wrote: > >> MikeCopeland writes: >> >>> Almost new to PHP, and I'm wondering if PHP will do something I want >>> to do. Scenario: >>> 1. 3 Web pages: index.php; text01.php; and people.php 2. In index.php >>> I want to establish a default value in a global >>> variable .... > >> Variables only persist for the duration of script/program execution. > >> You may want to look into using cookies > > Bad suggestion, the cookie gets passed to the user, they can change it. > Server data persisted in cookies can provide attack vectors. > >> or sessions > > Good suggestion, the only way the users can manipulate this is if they > manage to hit on a valid session cookie other than their own when > manipulating the cookie - sensible session cookie generation makes this > highly unlikely. > >> (or you could have some persistence via the query string). > > Very bad suggestion, query string is even easier for attackers to > manipulate than cookies. All true if the validity of the data needs to remain in-tact. I just skimmed his post and didn't really grok if he needed that, or just some persistent state to his site. If it's a persistent state that should be shared among users, the query string is actually very useful, as friends can then send the link back and forth. -- Matthew Carter (m@ahungry.com) http://ahungry.com