Hi,I agree with Ammar, the misusing of Request may make a security
hole, Foiling
Cross-Site Attacks one of the attacks that might happened by using Request (
as I think :) ), see this article by Chris Shiflett (
http://shiflett.org/articles/foiling-cross-site-attacks) .regards,
Hafez
On Dec 5, 2007 3:04 PM, Ammar Ibrahim <[EMAIL PROTECTED]> wrote:
> $_REQUEST is not a big no-no. My simple philosophy is: if your data is
> coming from GET, use $_GET, POST use POST but if it comes form both
> (depending on how you design the application) I use $_REQUEST. But generally
> it's always a good idea to minimize the use of $_REQUEST. $_REQUEST itself
> is not a security hole (like register_globals), but it might higher the
> possibility of making a mistake.
>
> register_globals is not the security risk per se, because that sounds
> like none sense. First you need to make a stupid mistake and the attacker
> needs access to the source code in order to be able to exploit it. The
> combination is not very common. But the reason why I hate register_globals
> is a very simple software engineering practice I like to follow; know where
> data is coming from. If I didn't have $_GET, $_POST... etc it would be a
> variable soup that is very hard to trace.
>
> - Ammar
>
>
> On Dec 5, 2007 2:35 PM, Al-Faisal El-Dajani <[EMAIL PROTECTED]>
> wrote:
>
> > Hey Guys,
> >
> > So far my understanding has been that using $_REQUEST is a complete
> > no-no. I've read multiple forum threads explaining how bad things could get,
> > and why not to use them. However, I was recently playing around with
> > SugarCRM, and as far as I can tell, they use it almost exclusively. A list
> > of parameters are sent in _GET, and when there is a form (method being POST
> > of course), hidden input fields are created to create the same parameter
> > list, and all handling is done using _REQUEST.
> >
> > Now, I know I am in no position to bad-mouth SugarCRM, but isn't it bad
> > practice to rely on _request? Could _request ever be considered good?
> >
> > --
> > Al-Faisal El-Dajani
> > Phone: +962-7-79737050
> > P.O Box: 140056
> > 11814 Amman, Jordan
> >
> >
>
> >
>
--
Hafez A.Ahmad
Amman-Jordan
mobile:962-785259011
962-795708728
http://blog.hafezadnan.com
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Jordan PHP Users Group" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/JoPHP
http://Jolug.org/
-~----------~----~----~----~------~----~------~--~---
