Web Hosting Talk







View Full Version : PHP script does not understand the variables from the URL?


Flasher
04-16-2007, 04:48 PM
PHP script does not understand the variables from the URL?

Hello, can you please help me with the following very strange problem? It is the first time I ever see a problem like this: the PHP script does not understand the variables passed to it by URL. To explain the point I made a very simple script test.php consisting of the text:

<?php
echo $signal;
?>

So if we call this script by browser as:
www.MyServer.com/test.php?signal=777
then it need output the text “777”. However, it does not do that.

To test if PHP in general works on this server I made another simple script like:

<?php
$signal = 888;
echo $signal;
?>

Which DID output the text “888”

Can somebody have an idea what is the problem?

Thank you!

jherbison
04-16-2007, 04:53 PM
Sounds like globals aren't set to on.

on the root folder you need to create the following file.

.htaccess (actual name of the file)

in the file you need this line only:

php_flag register_globals on

Thats it... Should fix the problem.

jlschwab
04-16-2007, 05:19 PM
It is a bad idea to use registered globals like that.

Instead you should be using:

$signal = $_REQUEST['signal'];

That is the proper way to do things. Register globals is insecure.

Flasher
04-16-2007, 05:35 PM
Thank you very much! I tried both approaches. And both of them worked.

jherbison, you are great!
jlschwab, you are great!

jlschwab
04-16-2007, 05:39 PM
Glad to be able to help. ;). Have a good day.

ergo
04-18-2007, 08:20 AM
someone should get a kick in his balls and read some docs , ALWAYS program with registered_globals off...


$signal = $_REQUEST['signal']; - this is a very bad example either....

use $_POST['signal'] for post data and $_GET['signal'] for your get ( url ) variables.

ALWAYS !!! i advise reading introductory sections from php doc about security.

Jay August
04-18-2007, 11:37 AM
someone should get a kick in his balls and read some docs , ALWAYS program with registered_globals off...
Indeed, shivers went down my spine after reading the first reply...

jlschwab
04-18-2007, 02:59 PM
I disagree, there is nothing wrong with using $_REQUEST[], it's more convenient and there are times in my scripts where I want to be able to access it via GET and POST! But I also always validate the users input completely. So its not a risk at all.

ergo
04-18-2007, 03:44 PM
I disagree, there is nothing wrong with using $_REQUEST[], it's more convenient and there are times in my scripts where I want to be able to access it via GET and POST! But I also always validate the users input completely. So its not a risk at all.
well, keep in mind that if Flasher (http://www.webhostingtalk.com/member.php?u=124717) asks for things like that in his first post means he is not pro, he is learning probably ( which is great thing ) . using $_REQUEST is the same as register globals on - and register globals is a programing nightmare and security risk ,that is why its disabled in php5 by default and WILL BE COMPLETLY REMOVED in php6.

a quote from php manual:
If you don't care where the request data comes from, you can use $_REQUEST as it contains a mix of GET, POST and COOKIE data.

ok, and what will happen when he does something like that ?
<?php
include($_REQUEST['file']);
?>
and his php installation has url wrappers enabled ? his *** is owned, dont you think ? there is always a place where you forget to check user input - we are all humans and make mistakes.

there are times in my scripts where I want to be able to access it via GET and POST
just being curious - can you make any example ? im not able to think of any now, but maybe you have some nice idea i did not think of earlier.

jlschwab
04-18-2007, 04:01 PM
Ok, I can agree from a learning standpoint, that he should probably not use, the $_REQUEST, ok, but $_REQUEST is *nothing* like having register_globals turned on. The variables are not directly accessed.

I guess I could consider using $_GET and $_POST, and I could use the ternary operator to set my variables as needed, I'll consider it. But i've seen no point.

Even though, you are right that registered globals will be completely gone as of php6, and that is a very good thing, it will not be getting rid of $_REQUEST AFAIK. It's too convenient.

But then again, Coding style and usage is up to the person writing it and how good they know the system its on, and the development environment.

As far as an example for what I quoted saying, sometimes I want to be able to access a search script of mine via search.php?query=x&start=x *and* I want the ability to fill out a form that has advanced query options, that would need to be posted.

(I write complex CMS's, so sometimes its needed, like in one CMS I have a advanced search page thats 3 pages long.).