>PHP: import_request_variables

DescripciÃ³n

bool import_request_variables ( string tipos [, string prefijo] )

Importa las variables GET/POST/Cookie en el contexto global. Es Ãºtil si usted ha deshabilitado register_globals, pero desea ver algunas variables en el contexto global.

Usando el parÃ¡metro tipos, es posible indicar cuÃ¡les variables de peticiÃ³n deben importarse. Puede usar los caracteres 'G', 'P' y 'C' respectivamente para indicar GET, POST y Cookie. Estos caracteres no son sensibles a mayÃºsculas o minÃºsculas, asÃ que puede usar cualquier combinaciÃ³n de 'g', 'p' y 'c'. POST incluye la informaciÃ³n de archivos cargados mediante POST. Note que el orden de las letras tiene importancia, ya que cuando usa "gp", las variables POST sobrescribirÃ¡n las variables GET con el mismo nombre. Cualquier otra letra diferente a GPC es descartada.

El parÃ¡metro prefijo es usado como prefijo para nombres de variables, que es colocado antes de todos los nombres de variables importados en el contexto global. De modo que si tiene un valor GET llamado "userid", y usa el prefijo "pref_", entonces obtendrÃ¡ una variable global llamada $pref_userid.

Si estÃ¡ interesado en importar otras variables en el contexto global, como SERVER, considere el uso de extract().

Nota: Aunque el parÃ¡metro prefijo es opcional, recibirÃ¡ un error de nivel E_NOTICE si no especifica el prefijo, o indica una cadena vacÃa como el prefijo. Este es un riesgo potencial de seguridad. Los errores de nivel de noticia no son mostrados usando el nivel de reporte de errores predeterminado.


<?php

// Esto importara las variables GET y POST con el prefijo "rvar_"



import_request_variables("gP", "rvar_");



echo $rvar_foo;

?>

Vea tambiÃ©n $_REQUEST, register_globals, Variables Predefinidas, y extract().

add a note User Contributed Notes
import_request_variables

samb06 at gmail dot com
15-May-2006 04:09


What i do is have a small script in my header file that takes an array called $input, and loops through the array to extract variables. that way the security hole can be closed, as you specify what variables you would like extracted



$input = array('name' => null, 'age' => 26) ;



// 26 is the default age, if $_GET['age'] is empty or not set



function extract_get()

    {

        global $input ;

        

        if ($input)

            {

                foreach ($input as $k => $v)

                    {

                        if ($_GET[$k] == '' or $_GET[$k] == NULL)

                            {

                                $GLOBALS[$k] = $v ;

                            }

                        else

                            {

                                $GLOBALS = $_GET[$k] ;

                            }

                    }

            }

    }

jason
08-Jul-2005 12:35


reply to ceo AT l-i-e DOT com:



I don't think it's a risk, as all of your request variables will be tagged with the prefix. As long as you don't prefix any of your internal variables with the same, you should be fine.



If someone tries to access an uninitiated security-related variable like $admin_level through request data, it will get imported as $RV_admin_level.

nexxer at rogers dot com
10-Feb-2005 10:47


PHP5 seems to have fixed that, in the sense that import_request_variables("g") works like extract($_GET). It doesn't seem to be passing a reference to the global, but instead creating a copy of it as expected

cornflake4 at gmx dot at
10-Jan-2005 02:52


oops, a typo in my comment:



The last line in the second example (the on using the extract() function) should read:



echo $_GET['var']; # prints 1, so $_GET has been unchanged

cornflake4 at gmx dot at
09-Jan-2005 09:39


Beware:



import_request_variables() does not copy the request variables into local scope variables. Instead, it copies the *reference* to the request variable content to local variables Important implication: any change to the local variable means a changes to the respective request variable, too!



This is a clear difference to extract($_GET) which copies the content of the request variables into local variables.



To shed some light on the implication, consider this (assuming the query string "...&var=1"):



echo $_GET['var']; # prints: 1

import_request_variables();

echo $var; # prints 1

$var = 2;

echo $_GET['var']; # prints 2 !!!!



So, $_GET has changed as well!



On the other hand:



echo $_GET['var']; # prints: 1

extract($_GET);

echo $var; # prints 1

$var = 2;

echo $_GET['var']; # prints 2 !!!!



Because of this, I recommend NOT using import_request_variables(), but extract($_GET); extract($_POST); extract($_COOKIE); instead, since this combination bears not these unexspected side effects.



PS: not to mention that you have to reconsider your coding style if any need to import_request_variables arises at all!

ceo AT l-i-e DOT com
10-Dec-2004 12:56


Call me crazy, but it seems to me that if you use this function, even WITH the prefix, then you might as well just turn register_globals back on...



Sooner or later, somebody will find a "hole" with your prefixed variables in an un-initialized variable.



Better to import precisely the variables you need, and initialize anything else properly.

brian at enchanter dot net
07-Dec-2004 05:19


import_request_variables does *not* read from the $_GET, $_POST, or $_COOKIE arrays - it reads the data directly from what was submitted. This is an important distinction if, for example, the server has magic_quotes turned on and you massage the data to run stripslashes on it; if you then use import_request_variables, your variables will still have slashes in them.



In other words: even if you say $_GET=""; $_POST=""; then use import_request_variables, it'll still get all the request data.



If you change the contents of $_GET and you then want to bring this data into global variables, use extract($_GET, EXTR_PREFIX_ALL, "myprefix") instead.

add a note

MANUAL DE PHP

windsurf mercedes camper

import_request_variables

DescripciÃ³n