ID: 29165 Updated by: [EMAIL PROTECTED] Reported By: guardkarma-php at yahoo dot com Status: Feedback Bug Type: *General Issues -Operating System: Mac OS X +Operating System: * PHP Version: 5.0.0 New Comment:
See also bug #29776 Previous Comments: ------------------------------------------------------------------------ [2005-03-06 20:43:48] [EMAIL PROTECTED] Please try using this CVS snapshot: http://snaps.php.net/php5-latest.tar.gz For Windows: http://snaps.php.net/win32/php5-win32-latest.zip ------------------------------------------------------------------------ [2004-08-17 19:58:44] jakub dot phpbug at horky dot net Yes, now I wanted to submit a bug regarding this and I found this. I think it should be at least documented as a change from PHP4, if not fixed. The simple fix diff (warning, I didn't check it against various vulnerabilities regarding to not addslashes()'ing the key...): http://jakub.horky.net/php5-fix-gpc-keys-quotes.patch ------------------------------------------------------------------------ [2004-07-21 23:27:36] guardkarma-php at yahoo dot com This problem also makes PHP 5 not 100% backward compatible. ------------------------------------------------------------------------ [2004-07-15 22:31:31] itsbrady-php at yahoo dot com I don't think the bug is bogus, for several reasons: #1) Any valid form input should be able to map to PHP. Sometimes PHP isn't the only programming environment present. Sometimes PHP might have to interoperate with other environments which might have different variable naming conventions, etc. #2) The entire reason we chose to use apostrophes in our form variable names was to work around PHP's remapping from . to _ within variable names (e.g., foo.var => foo_var). We can't just remap back from underscore to period to "regenerate" the original variable name, because that might remap legitimate uses of the underscore (example, foo_something.var gets mapped to foo_something_var, and if you tried to map it back you'd get foo.something.var, which doesn't match). #3) It used to work fine in all previous versions of PHP we've used (throughout the PHP 4.x series). #4) We certainly do not want PHP to create Global variables like $foo'var - that would be nuts. We just want to access a perfectly valid key in a hash - $_REQUEST["foo'var"]. There's no language rule against any such key, and no real reason not to support variables so named on forms. ------------------------------------------------------------------------ [2004-07-15 11:40:16] [EMAIL PROTECTED] We don't support variable names with wierd characters, so the result is undefined. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/29165 -- Edit this bug report at http://bugs.php.net/?id=29165&edit=1
