Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #15269

Re: Is there a better way?

Show all headers | View raw

On Wed, 15 Apr 2015 15:40:11 -0400, Lew Pitcher wrote:

> Consider
>   if (exists($_GET('123'))
>   {
>     // We can do useful work, knowing that the query asked for 123
> 
>     echo "Found the variable"
>     if (is_set($_GET('123'))
>       echo "The variable is set to $_GET('123')"
>     else
>       echo "The variable is not set"
>   }
>   else echo "Did not find the variable"

Lew, you're missing the point. The url was "request.php?=123" which 
results in a query string of =123 which doesn't set $_GET['123'], because 
php is looking for key=value pairs, doesn't populate the $_GET array with 
values for which no key exists.

What it does do however (and in this case the only way to access the 
data) is set $_SERVER['QUERY_STRING'] to '=123'

As an example, using the query string '?=123&x=99&=176&d=&f=1' on the 
code I posted for richard's education results in the following outputs:

$_SERVER['QUERY_STRING']:

=123&x=99&=176&d=&f=1

$_GET[]:	

Array
(
    [x] => 99
    [d] => 
    [f] => 1
)

Of course you can parse the query string yourself, here's a very simple 
query string parser:

$data = array();
$bits = explode('&', $_SERVER['QUERY_STRING']);
foreach ($bits as $bit) {
    $kv = explode('=', $bit);
    if ($kv[0] == '')                // no key, assign next numeric key
        $data[] = $kv[1];
    else if (!isset($data[$kv[0]]))  // key and key not repeat, use key
        $data[$kv[0]] = $kv[1];
    else {                           // repeat key, get creative
        $i = 0;
        while (isset($data[$kv[0].'_'.$i]))
            $i ++;
        $data[$kv[0].'_'.$i] = $kv[1];
    }
}

When fed a query string such as:

$_SERVER['QUERY_STRING']:	=123&x=99&=176&d=&f=1&x=6&x=8

it responds:

$data[]:

Array
(
    [0] => 123
    [x] => 99
    [1] => 176
    [d] => 
    [f] => 1
    [x_0] => 6
    [x_1] => 8
)

compared to:

$_GET[]:	

Array
(
    [x] => 8
    [d] => 
    [f] => 1
)

However, consider the following very carefully before trying to write or 
use such a parser:

(1) Injection attacks - could you be missing something that happens in 
the parsing of $_SERVER['QUERY_STRING'] into the $_GET array that exposes 
an injection attack?

(2) Do you really need to handle duplicated or missing key names in the 
post query? Surely it's better to fix those in the requesting page / 
form / link, and assume that any extras that do happen are attempts at 
query manipulation and should be discarded.

In other words, the best use of this may be to detect discrepancies 
between $_GET and $mget and if there are such discrepancies, abandon 
processing and return an "anomolous input detected, please try again" 
page.

-- 
Denis McMahon, denismfmcmahon@gmail.com

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is there a better way? Paul Knaggs <paul@tagmebands.co.uk> - 2015-04-13 19:47 -0700
  Re: Is there a better way? Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-14 07:54 -0400
  Re: Is there a better way? Paul Knaggs <paul@tagmebands.co.uk> - 2015-04-15 04:40 -0700
    Re: Is there a better way? Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-15 11:01 -0400
  Re: Is there a better way? richard <noreply@example.com> - 2015-04-15 15:04 -0400
    Re: Is there a better way? Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2015-04-15 15:40 -0400
      Re: Is there a better way? Lew Pitcher <lew.pitcher@digitalfreehold.ca> - 2015-04-15 17:14 -0400
      Re: Is there a better way? richard <noreply@example.com> - 2015-04-15 20:02 -0400
      Re: Is there a better way? Denis McMahon <denismfmcmahon@gmail.com> - 2015-04-16 15:18 +0000
      Re: Is there a better way? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-04-22 17:17 +0200
    Re: Is there a better way? "Beauregard T. Shagnasty" <a.nony.mous@example.invalid> - 2015-04-15 20:56 +0000
    Re: Is there a better way? Denis McMahon <denismfmcmahon@gmail.com> - 2015-04-16 01:25 +0000
    Re: Is there a better way? Evan Platt <evan@theobvious.espphotography.com.invalid> - 2015-04-17 07:35 -0700
      Re: Is there a better way? richard <noreply@example.com> - 2015-04-17 11:52 -0400
        Re: Is there a better way? Evan Platt <evan@theobvious.espphotography.com.invalid> - 2015-04-17 10:04 -0700
          Re: Is there a better way? Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-17 13:22 -0400
            Re: Is there a better way? richard <noreply@example.com> - 2015-04-17 14:49 -0400
              Re: Is there a better way? Evan Platt <evan@theobvious.espphotography.com.invalid> - 2015-04-17 12:20 -0700
              Re: Is there a better way? Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-17 15:27 -0400
        Re: Is there a better way? Evan Platt <evan@theobvious.espphotography.com.invalid> - 2015-04-17 10:30 -0700
          Re: Is there a better way? richard <noreply@example.com> - 2015-04-17 14:56 -0400
            Re: Is there a better way? Evan Platt <evan@theobvious.espphotography.com.invalid> - 2015-04-17 12:25 -0700
              Re: Is there a better way? Jerry Stuckle <jstucklex@attglobal.net> - 2015-04-17 15:29 -0400
              Re: Is there a better way? Tim Streater <timstreater@greenbee.net> - 2015-04-17 22:19 +0100
      Re: Is there a better way? Richard Yates <richard@yatesguitar.com> - 2015-05-24 15:22 -0700

csiph-web