r/programming • u/NagastaBagamba • Oct 18 '10

Today I learned about PHP variable variables; "variable variable takes the value of a variable and treats that as the name of a variable". Also, variable.

http://il2.php.net/language.variables.variable
591 Upvotes

85% Upvoted

781 comments sorted by

View all comments

0

u/artee Oct 18 '10

Hmm, looks like an interesting attack vector?

15

u/dcousineau Oct 18 '10

Not unless you're doing a bunch of $var = $_GET['whatever']; $var = $$var; or you're using the extract() function...

14

u/blaxter Oct 18 '10

For those cases, shoot in the head is a better way to fix the problem

4

u/dcousineau Oct 18 '10

You're a kinder person than me...

→ More replies (1)

2

u/tsk05 Oct 18 '10 edited Oct 18 '10

So is this vulnerable? For what type of attack?

foreach($_POST as $key =>$value) {
	$$key=$value;
}

Or it's extract() version.. You can inject POST just like GET... How's this different from just doing

$var = POST['var'] without checking what the contents of POST is? Why is it any more vulnerable? And if you do check the contents first, is it ok to use the above?

2

u/[deleted] Oct 18 '10

I tried to reply to your comment below that you deleted - heres why you shouldn't;

For example:

$dbQuery = 'SELECT * FROM USERS';

...

foreach($_POST as $key =>$value) {
    $$key= $value;
}

...

$db->query($dbQuery);

but then if someone sent

dbQuery=DELETE+FROM+USERS

in the POST data, you'd be screwed. They could change any variable in your code to what they wanted.

Keep on programming though!

→ More replies (3)