ID: 18088 Comment by: papercrane at reversefold dot com Reported By: gryaznov at guta dot ru Status: Bogus Bug Type: Variables related Operating System: Win2K (at least) PHP Version: 4.2.1 New Comment:
Nevertheless, this is a feature of your browser, not of PHP. The browser chooses to send the GET querystring and PHP should not be choosing whether or not to populate $_GET and not $_POST. If you're worried about this (and you should be), use $_GET and $_POST, not globals. Just turn register_globals off, it's a huge security hole. Previous Comments: ------------------------------------------------------------------------ [2004-06-04 10:22:28] ghoppy66 at hotmail dot com In other words; Alot of forms that post to themselves will have action='' for example, which will, as mentioned above, pass the previous Querystring even if the form's method is POST! Thus: <form method='post' action='<?=$_SERVER['PHP_SELF']?>'> will destroy the previous querystring. Not a bug? mmm ------------------------------------------------------------------------ [2002-07-01 09:52:35] [EMAIL PROTECTED] guess you wanted to assign 'test.php' to the form *action* not *name*? 'cause now, as you do not specify any action, it defaults to the page GET url, including parameters ... ------------------------------------------------------------------------ [2002-07-01 09:32:05] [EMAIL PROTECTED] This is actually a feature rather than bug. When you load the script first time, the get line does not have '?start=1' in it. Now, when you press the NOTSET button, it won't be set. But when you press SET button, the url will get '?start=1' and when you then press NOTSET, it will add it to $_GET array. This is very good reason why you should use $_GET / $_POST arrays and set register_globals=off ------------------------------------------------------------------------ [2002-07-01 09:07:21] gryaznov at guta dot ru Here is the test (file test.php): <HTML> <BODY> <FORM NAME=test.php METHOD=GET> <INPUT TYPE=HIDDEN NAME=start value=1> <INPUT TYPE=SUBMIT VALUE=SET> </FORM> <FORM NAME=test.php METHOD=POST> <INPUT TYPE=SUBMIT VALUE=NOTSET> </FORM> <BR> start value is: <?php echo $start ?><BR> </BODY> </HTML> When you click "set" button in browser, $start variable will be 1, when you click "notset" button after clicking "set" $start variable will be 1 also. Note: if register_globals is off you will need to use $_GET["start"] instead of $start, but it works also. (Though the method was POST, $_GET start variable should not be set) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=18088&edit=1
