smerny Posted November 19, 2009 Share Posted November 19, 2009 I want $PHP_SELF except ONLY return www.website.com/whatever.php, NOT www.website.com/whatever.php?blah=whatever Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/ Share on other sites More sharing options...
gizmola Posted November 19, 2009 Share Posted November 19, 2009 So I'm assuming that what you meant was $_SERVER['PHP_SELF']. There is no such thing as $PHP_SELF alone. If you look at the rest of the $_SERVER variables, there is this one: $_SERVER['SERVER_NAME'] Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960505 Share on other sites More sharing options...
smerny Posted November 19, 2009 Author Share Posted November 19, 2009 There is no such thing as $PHP_SELF alone. $PHP_SELF actually does work for me, but it copies the entire URL including the querystring Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960507 Share on other sites More sharing options...
cags Posted November 19, 2009 Share Posted November 19, 2009 I think $PHP_SELF is probably a deprecated feature, I can't find any information on it, but it does highlight in intellisense as being recognised. $_SERVER['PHP_SELF'] doesn't to my knowledge include $_GET variables though. Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960516 Share on other sites More sharing options...
smerny Posted November 19, 2009 Author Share Posted November 19, 2009 okay $_SERVER['php_self'] is doing what i was looking for Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960517 Share on other sites More sharing options...
cags Posted November 19, 2009 Share Posted November 19, 2009 Excellent. Just as a matter of point, if you do need the other value it would appear that $PHP_SELF actually returns the same things as $_SESSION['REQUEST_URI']. Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960524 Share on other sites More sharing options...
gizmola Posted November 19, 2009 Share Posted November 19, 2009 okay $_SERVER['php_self'] is doing what i was looking for My mind is just boggled here. $_SERVER['PHP_SELF'] is the name and path of the currently executing script, along with the full query string. If you had a $PHP_SELF, that was being created somewhere in your script. There is no variable named $_SERVER['php_self']. Could a $_SERVER['php_self'] be injected? Yes, I have seen frameworks and code doing that sort of thing -- going through the superglobals and injecting copies with the name lowercased. I don't think that's a great idea, but it can be done. Regardless, it would have the query string. Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960545 Share on other sites More sharing options...
gizmola Posted November 19, 2009 Share Posted November 19, 2009 I think $PHP_SELF is probably a deprecated feature, I can't find any information on it, but it does highlight in intellisense as being recognised. $_SERVER['PHP_SELF'] doesn't to my knowledge include $_GET variables though. It was deprecated long ago, and only works with Register globals on, also deprecated since 4.2. So apparently smerny is running on a server where register globals is turned on. Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960551 Share on other sites More sharing options...
smerny Posted November 19, 2009 Author Share Posted November 19, 2009 okay $_SERVER['php_self'] is doing what i was looking for My mind is just boggled here. $_SERVER['PHP_SELF'] is the name and path of the currently executing script, along with the full query string. If you had a $PHP_SELF, that was being created somewhere in your script. There is no variable named $_SERVER['php_self']. Could a $_SERVER['php_self'] be injected? Yes, I have seen frameworks and code doing that sort of thing -- going through the superglobals and injecting copies with the name lowercased. I don't think that's a great idea, but it can be done. Regardless, it would have the query string. i'm using $_SERVER['PHP_SELF'] and it is not including the querystring... i have a page that refreshes every 30 seconds... and there are things on that page that people can update, when you push the button to update it shows that you have updated and underneath of it it shows the content of the page... but the URL still had the query string in it so when it refreshed it would show the edit code instead of the content... now it works though, with the $_SERVER['PHP_SELF'] it does not use the querystring Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-960577 Share on other sites More sharing options...
gizmola Posted November 19, 2009 Share Posted November 19, 2009 Here's an article that discusses this issue in some detail: http://www.mc2design.com/blog/php_self-safe-alternatives. Ok... so I have to admit I airballed on this. $_SERVER['PHP_SELF'] doesn't include the query string. Disregard my prior comments on that. What I meant to say was that it includes the path, but this could include a bogus path, which is why this is vulnerable to XSS. Sorry for the confusion. Link to comment https://forums.phpfreaks.com/topic/182082-solved-php_self-without-the-querystring/#findComment-961306 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.