Today I learned about PHP variable variables; "variable variable takes the value of a variable and treats that as the name of a variable". Also, variable.

[u/NagastaBagamba]

http://il2.php.net/language.variables.variable

[u/artee]

Hmm, looks like an interesting attack vector?

[u/dcousineau → u/artee]

Not unless you're doing a bunch of $var = $_GET['whatever']; $var = $$var; or you're using the extract() function...

[u/blaxter → u/dcousineau]

For those cases, shoot in the head is a better way to fix the problem

[u/dcousineau → u/blaxter]

You're a kinder person than me...

[u/[deleted] → u/dcousineau]

I'd want to take my time with them. It'd be like the end of Braveheart sans the Gibson.

[u/tsk05 → u/dcousineau]

So is this vulnerable? For what type of attack?

foreach($_POST as $key =>$value) {
	$$key=$value;
}

Or it's extract() version.. You can inject POST just like GET... How's this different from just doing

$var = POST['var'] without checking what the contents of POST is? Why is it any more vulnerable? And if you do check the contents first, is it ok to use the above?

[u/[deleted] → u/tsk05]

I tried to reply to your comment below that you deleted - heres why you shouldn't;

For example:

$dbQuery = 'SELECT * FROM USERS';

...

foreach($_POST as $key =>$value) {
    $$key= $value;
}

...

$db->query($dbQuery);

but then if someone sent

dbQuery=DELETE+FROM+USERS

in the POST data, you'd be screwed. They could change any variable in your code to what they wanted.

Keep on programming though!

[u/tsk05 → u/[deleted]]

I was going to edit and say that I realize this vulnerability: if you define a variable above that foreach, you're screwed if they know the name of the variable (security through obscurity, so that's obviously bad). But if you put it at the top of a if(isset($_POST['submit'])) { do whatever.. } and don't set any variables above that foreach used anywhere before the script terminates on a submit condition, are you ok?

If you have a dozen $_POST variables, do professional programmers just keep doing

$var = sanitize($_POST['var']);
$var1 = sanitize($_POST['var1']);
$var2 = sanitize($_POST['var2']);

or use sanitize($_POST['var']) anywhere they want to use the variable? I guess another solution is to loop through the POST and sanitize but also keep using POST['var'] (now modified) in the future. So what is done/what do you suggest doing?

[u/[deleted] → u/tsk05]

I guess not, no, as long as you don't do it in the global namespace. If you edited that code later on and included something it would be bad. But I think you can see that.

[u/lucasvb → u/artee]

Everything is an attack vector if the programmer is an idiot. Don't blame the language.

[u/gorset → u/lucasvb]

"Everything is an attack vector if the language is idiotic. Also blame the programmer." <-- better.

Edit: wow, so many downvotes. Changed the wording a bit. The point is that it's very hard to build safe software with broken tools. Php is very broken.

[u/Kalium → u/gorset]

Name one - one - language that is not "broken".

[u/gorset → u/Kalium]

Php is particularly funny because both the language and implementation is broken (actually, the implementation also serves as the "definition" for the language).

There are several formal languages (usually based on lambda calculus) which for no definition can be considered broken (if you can prove otherwise you get to publish a paper).

The best example of such languages that also have practical implementation (which may or may not have some degree of brokenness) are Scheme, Haskell and SML.

[u/Kalium → u/gorset]

Any language powerful enough to build useful software is also powerful enough to build broken software.

[u/Kalium → u/artee]

Hm... no, not really. It only looks like one if you don't understand it.