#$_get

Easy Tip To Prevent SQL Injections

PHP Vulnerabilities 

if your working with PHP in your website then you have to also take into account security by looking for vulnerabilities within your website. Today I am going to be showing a small tip that will make it harder for the hacker to retrieve the table name in your database through the $_GET attribute. This won’t completely prevent it from happening but it will make it a whole lot…

Easy Tip To Prevent SQL Injections

PHP Vulnerabilities 

if your working with PHP in your website then you have to also take into account security by looking for vulnerabilities within your website. Today I am going to be showing a small tip that will make it harder for the hacker to retrieve the table name in your database through the $_GET attribute. This won’t completely prevent it from happening but it will make it a whole lot…

So if you really wanted to revamp this ancient API you probably want to do away with $_POST/$_GET/$_REQUEST/$_FILES superglobals altogether and really think about this problem for a second.

PHP deals with HTTP directly in many ways. It reads, parses, and sometimes even generates HTTP headers/bodies in key areas. Like when session_start() is called, PHP looks for an HTTP cookie header and seeks out the session_name() cookie then matches it against the available session storage data to either populate or initialize the $_SESSION superglobal.

So why is the HTTP request METHOD important in distinguishing which super global variable we use?

It isn't!

Things php populates $_POST are merely form url encoded parts of the HTTP request body. $_GET is populated from the request header's path string after parsing the query parameters (if any). So realistically anyone requesting support for $_PUT actually doesn't understand how HTTP works or how PHP deals with HTTP requests and how these superglobals are being populated.

The real problem here is that PHP doesn't parse the request body and populate it in $_POST unless the body is properly url encoded according the HTTP spec. Instead, you have to deal with the php://input stream directly and parse it yourself.

The PUT HTTP verb is intended to act upon the destination URI directly as per the enclosed entity, according to rfc2616. Yet, people seem to understand RESTful less than they regurgitate the word.

The fundamental difference between the POST and PUT requests is reflected in the different meaning of the Request-URI. The URI in a POST request identifies the resource that will handle the enclosed entity. That resource might be a data-accepting process, a gateway to some other protocol, or a separate entity that accepts annotations. In contrast, the URI in a PUT request identifies the entity enclosed with the request -- the user agent knows what URI is intended and the server MUST NOT attempt to apply the request to some other resource.

So let's forget about HTTP verbs for a second and deal with the HTTP request through some sane (non-backwards-compatible) interface.

First, make PhpRequest a new extensible interface, expose it to userland, and allow the user to override it's implementation with user-implemented classes. Second, stop making the request parsing and content buffer flushing decisions at the RINIT stage. Let's just buffer and delegate to the runtime!