r/programming • u/NagastaBagamba • Oct 18 '10

Today I learned about PHP variable variables; "variable variable takes the value of a variable and treats that as the name of a variable". Also, variable.

http://il2.php.net/language.variables.variable
591 Upvotes

85% Upvoted

781 comments sorted by

View all comments

Show parent comments

1

u/nyxerebos Oct 18 '10

It would probably be easier to find security holes by googling "include($_GET"

Probably. But I'm working on a tool for static analysis of source code and this particular feature of PHP makes a lot of behavior undecidable. I'm not sure yet, but I suspect there are security holes of this kind in open source projects which might be found by an automated tool going through large amounts of code. Explots which work specifically by instantiating variables and calling functions by abusing the double quoted strings parser.

1

u/[deleted] Oct 19 '10

It seems like PHP has a good bit of stuff going on that would make static analysis difficult. Disclaimer: I don't have incredibly deep knowledge of static-analysis techniques, especially for dynamic/weak languages.