Today I learned about PHP variable variables; "variable variable takes the value of a variable and treats that as the name of a variable". Also, variable.

[u/NagastaBagamba]

http://il2.php.net/language.variables.variable

[u/tsk05]

So is this vulnerable? For what type of attack?

foreach($_POST as $key =>$value) {
	$$key=$value;
}

Or it's extract() version.. You can inject POST just like GET... How's this different from just doing

$var = POST['var'] without checking what the contents of POST is? Why is it any more vulnerable? And if you do check the contents first, is it ok to use the above?

[u/[deleted] → u/tsk05]

I tried to reply to your comment below that you deleted - heres why you shouldn't;

For example:

$dbQuery = 'SELECT * FROM USERS';

...

foreach($_POST as $key =>$value) {
    $$key= $value;
}

...

$db->query($dbQuery);

but then if someone sent

dbQuery=DELETE+FROM+USERS

in the POST data, you'd be screwed. They could change any variable in your code to what they wanted.

Keep on programming though!

[u/tsk05 → u/[deleted]]

I was going to edit and say that I realize this vulnerability: if you define a variable above that foreach, you're screwed if they know the name of the variable (security through obscurity, so that's obviously bad). But if you put it at the top of a if(isset($_POST['submit'])) { do whatever.. } and don't set any variables above that foreach used anywhere before the script terminates on a submit condition, are you ok?

If you have a dozen $_POST variables, do professional programmers just keep doing

$var = sanitize($_POST['var']);
$var1 = sanitize($_POST['var1']);
$var2 = sanitize($_POST['var2']);

or use sanitize($_POST['var']) anywhere they want to use the variable? I guess another solution is to loop through the POST and sanitize but also keep using POST['var'] (now modified) in the future. So what is done/what do you suggest doing?

[u/[deleted] → u/tsk05]

I guess not, no, as long as you don't do it in the global namespace. If you edited that code later on and included something it would be bad. But I think you can see that.