Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!nuzba.szn.dk!pnx.dk!fu-berlin.de!uni-berlin.de!not-for-mail
From: "M. Strobel" <sorry_no_mail_here@nowhere.dee>
Newsgroups: comp.lang.php
Subject: Re: Magic quotes? Should I still be cautious?
Date: Fri, 06 Jan 2012 18:05:17 +0100
Lines: 75
Message-ID: <9monudFsveU1@mid.uni-berlin.de>
References: <apkpf7pepdppho2ve4fr8nu8u087hmcakl@4ax.com> <4F046877.3080409@arnowelzel.de> <4f05a0b4$0$6924$e4fe514c@news2.news.xs4all.nl> <9mmq09F283U1@mid.uni-berlin.de> <4f06c7f3$0$6876$e4fe514c@news2.news.xs4all.nl>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Trace: news.uni-berlin.de M0HoegIPrldYnSjkVZE6eA4HJEtF/MJk9lrryuyioUYrcCCZo=
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.24) Gecko/20111101 SUSE/3.1.16 Lightning/1.0b2 Thunderbird/3.1.16
In-Reply-To: <4f06c7f3$0$6876$e4fe514c@news2.news.xs4all.nl>
Xref: x330-a1.tempe.blueboxinc.net comp.lang.php:4233

Am 06.01.2012 11:07, schrieb Erwin Moller:
> On 1/6/2012 12:28 AM, M. Strobel wrote:
>> Am 05.01.2012 14:08, schrieb Erwin Moller:
>>>

-----------cut on various places

> Hi Strobel,
> 
> And why do you prefer $_REQUEST over using the exact superglobal?
> You do know where the information is supposed to come from.
>
Yes I know that exactly. But why care? When I expect data I do

function getIntFromForm($key, $def=null) {
    if (isset($_REQUEST[$key])) {
        if ($a = sscanf($_REQUEST[$key], '%d')) {   // unsigned
            $def = $a[0];
        } else {
            # keine Zahl im Wert $key / no number
        }
    } else {
        # key nicht gefunden / no key
    }
    return $def;
}

> 
>>
>> But then I have to mention my setup with a sort of call
>> dispatcher: the called function is looked up in a list taking
>> into account $_SERVER['REQUEST_METHOD'].
> 
> That explanation makes no sense to me without any more context.
> Are you saying you are limiting access to certain function by
> checking the used $_SERVER['REQUEST_METHOD']?
> If so, that won't help at all, since anybody could still use the
> "right" REQUEST_METHOD and manipulate the contents of GPC at the
> same time.

This is correct, it is not a real protection, but part of the
request processing. And the correct request processing takes care
to only read in and verify expected data.

>>
>> All user input must be verified, no matter if it's in $_GET,
>> $_POST, $_COOKIE or $_REQUEST for that matter - they can all be
>> faked!
> 
> Of course.
> But how does that relate to using $_REQUEST over the exact
> superglobal?

if (is-a-post-operation AND data-expected)
   read post data;
elseif (is-a-get-operation AND data-expected)
   read get data;

What for? Just do
if (data-expected)  read request data.


> If you think I am wrong about that, please tell me why.
> I had this discussion a few years back too, but the guy turned
> out to be a troll (and silly me took the bait!), so that turned
> out to be a dead end.

Always check data on input :-)

> 
> Regards,
> Erwin Moller
> 

/Str.