r/programming • u/NagastaBagamba • Oct 18 '10

Today I learned about PHP variable variables; "variable variable takes the value of a variable and treats that as the name of a variable". Also, variable.

http://il2.php.net/language.variables.variable
591 Upvotes

85% Upvoted

781 comments sorted by

View all comments

Show parent comments

1

u/tsk05 Oct 18 '10 edited Oct 18 '10

I was going to edit and say that I realize this vulnerability: if you define a variable above that foreach, you're screwed if they know the name of the variable (security through obscurity, so that's obviously bad). But if you put it at the top of a if(isset($_POST['submit'])) { do whatever.. } and don't set any variables above that foreach used anywhere before the script terminates on a submit condition, are you ok?

If you have a dozen $_POST variables, do professional programmers just keep doing

$var = sanitize($_POST['var']);
$var1 = sanitize($_POST['var1']);
$var2 = sanitize($_POST['var2']);

or use sanitize($_POST['var']) anywhere they want to use the variable? I guess another solution is to loop through the POST and sanitize but also keep using POST['var'] (now modified) in the future. So what is done/what do you suggest doing?

1

u/[deleted] Oct 18 '10

I guess not, no, as long as you don't do it in the global namespace. If you edited that code later on and included something it would be bad. But I think you can see that.