#20796 [Opn->Bgs]: Overridden Get, Post and Cookie data with register_globals turned on

[iliaa]

 ID:               20796
 Updated by:       [EMAIL PROTECTED]
 Reported By:      [EMAIL PROTECTED]
-Status:           Open
+Status:           Bogus
 Bug Type:         Variables related
 Operating System: Red Hat 8.0
 PHP Version:      4.2.2
 New Comment:

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

This is why register_globals is dangerous, if there are variables with
the same name they get over-written. This is why you should keep it
off.
You can control the order of the way variables passed via
GET/POST/COOKIE/FILES are registered via the gpc_order ini setting.


Previous Comments:
------------------------------------------------------------------------

[2002-12-03 12:25:22] [EMAIL PROTECTED]

With register_globals turned on, if 3 variables WITH THE
SAME NAME are defined in your script (one as a Get
variable, one as a Post variable and one as a Cookie
variable) and if this name is an ARRAY ELEMENT (let's
say foo[ab]), then $_GET["foo"]["ab"] and
$_POST["foo"]["ab"] will both be set to $_COOKIE["foo"]["ab"].

Let's try it.

First, write the script "print_gpc.php" :

<?php
echo '$_GET';
echo "<PRE>";
print_r($_GET);
echo "</PRE>";

echo '$_POST';
echo "<PRE>";
print_r($_POST);
echo "</PRE>";

echo '$_COOKIE';
echo "<PRE>";
print_r($_COOKIE);
echo "</PRE>";
?>

Then call the form below ("test.php") in your browser :

<?php setcookie("foo[ab]","I_am_a_cookie"); ?>
<FORM METHOD="POST" ACTION="print_gpc.php?foo[ab]=I_am_a_get_value">
<INPUT TYPE="submit" NAME="foo[ab]" VALUE="OK">
</FORM>

and clic on the OK button.

If you have register_globals turned off, you will see
what you expect :

$_GET

Array
(
    [foo] => Array
        (
            [ab] => I_am_a_get_value
        )

)

$_POST

Array
(
    [foo] => Array
        (
            [ab] => OK
        )

)

$_COOKIE

Array
(
    [foo] => Array
        (
            [ab] => I_am_a_cookie
        )

)

but if you have register_globals turned on,
you will have $_GET["foo"]["ab"] == "I_am_a_cookie"
and $_POST["foo"]["ab"] == "I_am_a_cookie".

Strangly, this problem does not occur if the cookie name
is NOT an array element EVEN if register_globals is
turned On. (Try to replace "foo[ab]" by "foo" in the
"test.php" form.)



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=20796&edit=1