Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #15229 > unrolled thread

replacing import_request_variables with extract - not working ...

Back to article view | Back to comp.lang.php

Contents

  replacing import_request_variables with extract - not working ... Richard Townsend-Rose <richard.townsendrose@gmail.com> - 2015-04-11 06:08 -0700
    Re: replacing import_request_variables with extract - not working ... Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-11 09:33 -0400
    Re: replacing import_request_variables with extract - not working ... Richard Townsend-Rose <richard.townsendrose@gmail.com> - 2015-04-11 07:04 -0700
      Re: replacing import_request_variables with extract - not working ... Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-11 10:37 -0400
    Re: replacing import_request_variables with extract - not working ... "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-04-11 16:11 +0200
    Re: replacing import_request_variables with extract - not working ... Richard Townsend-Rose <richard.townsendrose@gmail.com> - 2015-04-11 09:05 -0700
      Re: replacing import_request_variables with extract - not working ... Richard Yates <richard@yatesguitar.com> - 2015-04-11 09:24 -0700
        Re: replacing import_request_variables with extract - not working ... "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-04-11 19:23 +0200
      Re: replacing import_request_variables with extract - not working ... Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-11 14:44 -0400

#15229 — replacing import_request_variables with extract - not working ...

Hi

being a bit thick here ... 

updating to php 5.5 after many years not using php ...

used to use this.
	// get variables from form, etc
	// import_request_variables('p', 'F_');       // turn posted vars to F_var

its now deprecated, so trying this:
	extract($_POST, EXTR_PREFIX_ALL, 'F_');

but it is not creating F_ver for example

have checked with print_r($_POST); and the variables are going up ...

must be losing then plot at 70 !

the system is complex and has been working for years - see tdoc.com which is written in ca visual objects - on which group i have posted lots

richard

[toc] | [next] | [standalone]

#15230

On 4/11/2015 9:08 AM, Richard Townsend-Rose wrote:
> Hi
> 
> being a bit thick here ... 
> 
> updating to php 5.5 after many years not using php ...
> 
> used to use this.
> 	// get variables from form, etc
> 	// import_request_variables('p', 'F_');       // turn posted vars to F_var
> 
> its now deprecated, so trying this:
> 	extract($_POST, EXTR_PREFIX_ALL, 'F_');
> 
> but it is not creating F_ver for example
> 
> have checked with print_r($_POST); and the variables are going up ...
> 
> must be losing then plot at 70 !
> 
> the system is complex and has been working for years - see tdoc.com which is written in ca visual objects - on which group i have posted lots
> 
> richard
> 

A huge security risk.  It allows someone to insert virtually any
variable into your script - almost as secure as register_globals (which
also has been deprecated, for security reasons).

Your should look for each variable in the $_POST array that you are
expecting to find, and process it.

The fact that "it has been working for years" does not make it any more
secure.  It looks like its time to fix it right.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#15231

Jerry

thanks for that

first to stop injection i have as below:

this one script process's seven different foprms with some common and some other variables - never been a problem.

but if that is what has to happen so be it.

but never the less why does extract not work ?????

richard

// ************************************************************
    // check for spamming [v4 & v5]
    function detect_spam($arr_variables) {
       $msg = "Error in Form - Spam Detected<BR>" ;
       $result = false ;
       foreach ($arr_variables as $key => $var ) {
       	
//          if (eregi( "(%0D)|(%0A)|(0x0A)|(0x0D)|(MIME-Version)|
//          (Content-Type)|(Content-Transfer)|(Content-Disposition)|
//          (boundary=)|(Return-Path)", $var ) )

 			if (preg_match("/ (%0D)|(%0A)|(0x0A)|(0x0D)|(MIME-Version)|
 			(Content-Type)|(Content-Transfer)|(Content-Disposition)|
 			(boundary=)|(Return-Path)/", $var))
		  
		  {
                $msg.= "<BR>In $key, found $var" ;
                $result = true ;
          }
       }
       if ($result) {
          tdocprint($msg, false) ;
       }
       return $result ;
     }

[toc] | [prev] | [next] | [standalone]

#15233

On 4/11/2015 10:04 AM, Richard Townsend-Rose wrote:
> Jerry
> 
> thanks for that
> 
> first to stop injection i have as below:
> 
> this one script process's seven different foprms with some common and some other variables - never been a problem.
> 
> but if that is what has to happen so be it.
> 
> but never the less why does extract not work ?????
> 
> richard
> 

<snip code>

There's never a problem until something bad happens.  Then it's a huge
problem.  And your code does find some potential problems.  But it won't
stop a good hacker.

Best is to handle the variables as they occur in $_POST and not try to
import unknown variables into your script.  This way any potentially bad
stuff is isolated and won't affect the rest of your code.

P.S. When replying, it's considered good form to quote the applicable
parts of the message you are replying to, then reply inline or following
the copied message.  Most of us use real usenet readers instead of the
poor Google interface to usenet, and previous messages may or may not be
available.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#15232

Richard Townsend-Rose wrote:

> being a bit thick here ... 
> 
> updating to php 5.5 after many years not using php ...
> 
> used to use this.
> 	// get variables from form, etc
> 	// import_request_variables('p', 'F_');       // turn posted vars to F_var
> 
> its now deprecated, so trying this:
> 	extract($_POST, EXTR_PREFIX_ALL, 'F_');
> 
> but it is not creating F_ver for example

Read the description of the $prefix parameter[1] more carefully: it
automatically adds an undescore character.  So with your current code
you have $F__ver (two underscores).

[1] <http://php.net/manual/en/function.extract.php>

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#15234

Christopher

Exactly the reply needed ... but I am damned if I can read that prefix adds an underscore in the text.

Anyway working a treat.

Jerry - We have a methodology for checking any unwanted vars that ends any processing.

richard

[toc] | [prev] | [next] | [standalone]

#15235

On Sat, 11 Apr 2015 09:05:40 -0700 (PDT), Richard Townsend-Rose
<richard.townsendrose@gmail.com> wrote:

>Christopher
>
>Exactly the reply needed ... but I am damned if I can read that prefix adds an underscore in the text.
>
>Anyway working a treat.
>
>Jerry - We have a methodology for checking any unwanted vars that ends any processing.
>
>richard

I went there and also could not find it at first. Wrote a little
script to confirm that and undescore was added, then went back to
http://php.net/manual/en/function.extract.php and there it was, right
in plain sight:

"prefix 
    Note that prefix is only required if flags is EXTR_PREFIX_SAME,
EXTR_PREFIX_ALL, EXTR_PREFIX_INVALID or EXTR_PREFIX_IF_EXISTS. If the
prefixed result is not a valid variable name, it is not imported into
the symbol table. Prefixes are automatically separated from the array
key by an underscore character."

Feeble minds think alike...

[toc] | [prev] | [next] | [standalone]

#15236

Richard Yates wrote:

> On Sat, 11 Apr 2015 09:05:40 -0700 (PDT), Richard Townsend-Rose
> <richard.townsendrose@gmail.com> wrote:
> 
>> Christopher
>>
>> Exactly the reply needed ... but I am damned if I can read that prefix adds an underscore in the text.
>>
>> Anyway working a treat.
>>
>> Jerry - We have a methodology for checking any unwanted vars that ends any processing.
>>
>> richard
> 
> I went there and also could not find it at first. Wrote a little
> script to confirm that and undescore was added, then went back to
> http://php.net/manual/en/function.extract.php and there it was, right
> in plain sight:
> 
> "prefix 
>     Note that prefix is only required if flags is EXTR_PREFIX_SAME,
> EXTR_PREFIX_ALL, EXTR_PREFIX_INVALID or EXTR_PREFIX_IF_EXISTS. If the
> prefixed result is not a valid variable name, it is not imported into
> the symbol table. Prefixes are automatically separated from the array
> key by an underscore character."
> 
> Feeble minds think alike...

It might be possible, though, that this part of the manual is missing on
a mirror or in a translation.  If so, please file a bug report.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#15237

On 4/11/2015 12:05 PM, Richard Townsend-Rose wrote:
> Christopher
> 
> Exactly the reply needed ... but I am damned if I can read that prefix adds an underscore in the text.
> 
> Anyway working a treat.
> 
> Jerry - We have a methodology for checking any unwanted vars that ends any processing.
> 
> richard
> 

I've seen a lot of people who claimed the same.  Not a single one was
secure.  Hackers are quite good at what they do.

But if you don't care about security, it's no skin off of my back.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web