3 ms·
Don't use $_POST and $_GET globals directly May I ask why not?
by EvilTerran 13y ago
Don't use $_POST and $_GET globals directly
May I ask why not?
- krapp 13y agoIf they aren't sanitized or validated they can generate exceptions or contain malicious data which leads to XSS or SQL injection after they've been reflected back to the user or added to a database. Since the values in these arrays come from the user, they should always be considered actively hostile and treated as such.
- EvilTerran 13y agoAh, gotcha. So, treat them like they're "tainted", in perl parlance. I was thinking that remark was intended more along the lines of "never use $_GET and $_POST directly, only ever access them via something like Symfony's sfWebRequest::getGetParameter/getParameterHolder/etc", which struck me as a bit overzealous as such rules go.
- krapp 13y agoYeah, just make sure somewhere you're doing all the checking (type, length, character set, providing sane defaults, etc.) that other languages probably do for you. Because users are evil and want to destroy you and PHP is only too happy to help them... :\
- EvilTerran 13y agoYeah, I often feel like PHP is trying to destroy me. / used Haskell at uni, loved it // first job in the real world is... web dev, on a sprawling legacy PHP codebase, with no documentation or tests /// I miss my static guarantees :(