From: crmalibu at gmail dot com
Operating system: n/a
PHP version: 5.2.9
PHP Bug Type: Variables related
Bug description: unexpected gpc variable parsing
Description:
------------
I marked the version as 5.2.9 but it looks like the relevant code is the
same for 5.3 and php 6 as well.
I don't know c, so I struggle to read the source code, but I think I found
something unexpected. In main/php_variables.c in php_register_variable_ex I
think the parsing behaves inconsistent.
After reading the comments in the source code, I would think a gpc
variable name should not make it through which has ' ' or '.' or '['
character in the name. But I've found a way to do it. It seems the routine
for recognizing and parsing the array syntax is at fault.
In particular, characters after the first occurrence of a '[' char will be
left alone because it thinks it needs to parse it as the special array
syntax. But while it does later recognize that it's not proper array
syntax, it doesn't properly convert the remaining character to underscore.
I don't know if this is a bug, or if it's serious or what. But the source
code comment about removing those chars due to not being binary safe made
me think someone needs to look at this.
Reproduce code:
---------------
<form action=>
<input name="goodvar .[">
<input name="goodarray[foo]">
<input name="badvar[ . [">
<input type=submit>
</form>
<?php
print_r($_GET);
?>
Expected result:
----------------
Array
(
[goodvar___] =>
[goodarray] => Array
(
[foo] =>
)
[badvar_____] =>
)
Actual result:
--------------
Array
(
[goodvar___] =>
[goodarray] => Array
(
[foo] =>
)
[badvar_ . [] =>
)
--
Edit bug report at http://bugs.php.net/?id=48597&edit=1
--
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=48597&r=trysnapshot52
Try a CVS snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=48597&r=trysnapshot53
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=48597&r=trysnapshot60
Fixed in CVS:
http://bugs.php.net/fix.php?id=48597&r=fixedcvs
Fixed in CVS and need be documented:
http://bugs.php.net/fix.php?id=48597&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=48597&r=alreadyfixed
Need backtrace:
http://bugs.php.net/fix.php?id=48597&r=needtrace
Need Reproduce Script:
http://bugs.php.net/fix.php?id=48597&r=needscript
Try newer version:
http://bugs.php.net/fix.php?id=48597&r=oldversion
Not developer issue:
http://bugs.php.net/fix.php?id=48597&r=support
Expected behavior:
http://bugs.php.net/fix.php?id=48597&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=48597&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=48597&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=48597&r=globals
PHP 4 support discontinued: http://bugs.php.net/fix.php?id=48597&r=php4
Daylight Savings: http://bugs.php.net/fix.php?id=48597&r=dst
IIS Stability:
http://bugs.php.net/fix.php?id=48597&r=isapi
Install GNU Sed:
http://bugs.php.net/fix.php?id=48597&r=gnused
Floating point limitations:
http://bugs.php.net/fix.php?id=48597&r=float
No Zend Extensions:
http://bugs.php.net/fix.php?id=48597&r=nozend
MySQL Configuration Error:
http://bugs.php.net/fix.php?id=48597&r=mysqlcfg
