question regarding syntax style in form variables

[thosecars82]

I have read that there are 3 choices of syntax style for form variables depending on the php version you are running and depending on how is your register_globals parameter set:

 

$variable

 

$_POST['variable']

 

$HTTP_POST_VARS['variable']

 

I would appreciate if anybody could tell me where i can find and modify this parameter manually to activate each of these choices of syntax. Moreover, I think it might be useful to be able to decide dynamically the type of syntax you must use in your code to access form variables. Furthermore, this would make it easy to migrate the code between different php versions. I guess developers will use something like this, right? For that reason it would be great if somebody could tell me if there is an easy way to do it.

 

[uniflare]

you should always code your scripts for register_globals off. eg using _POST array.

 

Alsways code for register_globals off but always assume its on, so make sure any normal variable you are using is set by the script (E_NOTICE warnings will show likely innjection variables).

 

i believe HTTP_POST_VARS is deprecated, jsut use _POST and _GET it should work on EVERY installation of php 4+5 amybe 3

[thosecars82]

Thanks, that's what i had read, using _post and _get was the suggested way in the book i read. I just thought people might check it dinamically just in case.thks

[uniflare]

FYI to check certain server variables you could use either:

 

$_SERVER array,

ini_get() function

or $_ENV etc.

[thosecars82]

good to know.thks