PHP automatically assigning GET data...

Discussion in 'PHP' started by davedx, Mar 25, 2005.

  1. #1
    Ok well since I can't seem to delete this post, I'll explain what it was about so maybe other people won't make the same mistake I did.

    I was having a XSS problem in that one of my variables ($username) was being poisoned. It took me a bit of digging around in the PHP manual to determine it was being set because register_globals was turned on, which automatically assigns variables to GET attributes. So if you have code like:

    
    if( isset( $_POST['username'] ) )
    {
      $username = $_POST['username'];
    }
    
    Code (markup):
    ...and $username isn't initialised in the scope of the whole script, then it can get poisoned by someone typing "script.php?username=nastystring".

    The fix is to be a good programmer, unlike me, and always initialise your variables - i.e. put "$username = '';" at the top of the script.

    *goes away to bang his head on a wall for sloppy code*
     
    davedx, Mar 25, 2005 IP
  2. sarahk

    sarahk iTamer Staff

    Messages:
    28,918
    Likes Received:
    4,560
    Best Answers:
    124
    Trophy Points:
    665
    #2
    Thanks for documenting that davedx - you won't forget in a hurry ;)

    I have scripts called getPostVar and getGetVar which manage this for me

    
    function getGetVar($name, $default='')
    {
    	global $_GET;
    	if (isset($_GET[$name])) $output = $_GET[$name];
    	else $output = $default;
    	return $output;
    }//getGetVar
     
    $username = getGetVar('username');
    
    Code (markup):
    I can add validation etc to that and intval() around values is always a good plan. The function gets hidden away in your functions script and you're left with nice clean function calls.
     
    sarahk, Mar 26, 2005 IP
  3. J.D.

    J.D. Peon

    Messages:
    1,198
    Likes Received:
    65
    Best Answers:
    0
    Trophy Points:
    0
    #3
    register_globals is off by default (v4.2+). If it's on, you might want to talk to your hosting company and have it disabled.

    More info on this for those who are interested:

    http://ca.php.net/manual/en/security.globals.php

    J.D.
     
    J.D., Mar 26, 2005 IP
  4. davedx

    davedx Peon

    Messages:
    429
    Likes Received:
    21
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Yeah I read that on the php site... apparently both my web hosts have it turned on :eek:
     
    davedx, Mar 26, 2005 IP