Hello, On 8/12/06, Richard Lynch <[EMAIL PROTECTED]> wrote:
But I think you are talking about making changes to the way this works: http://example.com/?foo=%20.123 <?php $foo = $_GET['foo']; if (is_numeric($foo)){ //error out } $query = "something involving '$foo'"; ?> If you break that, you're in big trouble to a lot of scripts all over the planet, which rely on the leading space to trap their SQL problem.
This example has nothing to do with what we are discussing here. There is no conversion or detection involved here. It is a simple string concatenation.
I never actually use is_numeric, and would expect it to follow the same "rules" as PHP's internal type-juggling mechanism. I believe leading spaces should NOT be allowed for type-juggling, not is_numeric, because GET/POST/COOKIE data should be subject to the most stringent constraints reasonable to avoid security injections.
Any example?
While I don't think leading/trailing spaces are likely to constitute a Security Issue, there is a Principle at work that I think should be applied.
Principle? which is? :) --Pierre -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php
