CODEWITHSUNDEEP
phpextract
user1039769
user1039769

Reputation: 225

PHP extracting without extract()

I have something like:

    if(isset($_POST['submit']))
    {
    $linktitle=strtolower(str_replace(" ","-",$title));

etc.

$linktitle and $title are actually variables from $_POST - ie $_POST['linktitle'] and $_POST['title']. Somehow, even though (as far as I can see!) I haven't extract()ed $_POST at this stage in the code, it is still working - PHP is understanding that $title is referring to $_POST['title']. Could anyone please explain why this might be?

Thanks!

ps. Sorry, but I really can't get this inline code quote formatting thing to work...!

Upvotes: 0

Views: 96

Answers (3)

ocirocir
ocirocir

Reputation: 4048

You have register globals activated in your webserver (php.ini), so PHP replace the unknoe variables with the corresponding GET or POST value. This option is deprecated and dangerous! Disable it if you can!

Upvotes: 1

Niet the Dark Absol
Niet the Dark Absol

Reputation: 324630

Your php.ini file must have register_globals enabled, so GPC variables are being added to the symbol table. This is why you see this behaviour. See the security risks of such a feature here

Upvotes: 1

DaveRandom
DaveRandom

Reputation: 88647

register_globals is enabled in your PHP instance. See here for more info.

This is behaviour that should be relied upon as it's use is now deprecated. You will find that you can still use $_POST['keyname'] as well as $keyname, and that is what you should refer to in your code.

Upvotes: 3

Related Questions