$_SESSION variables being controlled by PHP configuration?

Question

I commonly see people setting $_SESSION variables as

$_SESSION['example']=$_REQUEST['something'];
$example=$_SESSION['example'];

is this redundant?

I am currently working on a new server and

$_SESSION['example']=$_REQUEST['something'];

gives me access to $example without any extra code

is this normal or a php configuration making my life easier but potentially more dangerous?

Matthew Vines · Accepted Answer · 2009-09-08 01:13:59Z

5

This sounds like a php.ini directive called register_globals is on for the server you are working with. This is considered bad practice, and is even deprecated and removed in the latest releases of php. check out this portion of the php documentation for more details.

http://www.php.net/manual/en/security.globals.php

Edit - as it pertains to your comment.

You should never trust the input provided by your users, and should sanitize it by removing or neutralizing characters that could be used for cross site scripting, injection attacks, or just crap data from getting into your session, cookies, or database.

check out the following to get up to speed.

http://www.codeassembly.com/How-to-sanitize-your-php-input/

http://www.phpbuilder.com/columns/sanitize_inc_php.txt

http://www.devshed.com/c/a/PHP/Sanitizing-Strings-with-Filters-in-PHP-5/

edited Sep 8, 2009 at 1:13

answered Sep 7, 2009 at 23:19

Matthew Vines

27.7k7 gold badges80 silver badges99 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

chris Over a year ago

That was it thank you What is the best way to set SESSION variables?

Matthew Vines Over a year ago

the best way is to retrieve it from the appropriate area, $_GET, or $_POST, rather than $_REQUEST whenever possible, sanitize the input into a new variable, and then set that value to the session. You can then retrieve those values from the session either directly, or as I prefer, you can set variables in your code from the session, and work with those.

Ólafur Waage · Accepted Answer · 2009-09-07 23:18:02Z

1

There is no difference in the first code and the second code. There seems to be a contingent that putting global variables into a local variable, makes them safe. But it's not.

You should treat anything that comes from user space. (POST, GET, REQUEST, COOKIE) like it is infected.

answered Sep 7, 2009 at 23:18

Ólafur Waage

70.3k22 gold badges147 silver badges199 bronze badges

Comments

janoliver · Accepted Answer · 2009-09-07 23:18:54Z

1

that only happens when "register_globals" is set to "on", which is not recommended!

answered Sep 7, 2009 at 23:18

janoliver

7,84014 gold badges64 silver badges105 bronze badges

Collectives™ on Stack Overflow

$_SESSION variables being controlled by PHP configuration?

3 Answers 3

Edit - as it pertains to your comment.

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Edit - as it pertains to your comment.

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related