tags:

views:

30

answers:

2

hi ,

for testing i switch on the register global ,

<form>
<input type="text" name="txt_name">
<input type="submit" value="Submit">
</form>
   print_r($+txt_name);
  //Parse error: parse error, expecting `T_VARIABLE' or `'$'' in F:\wamp\www\sample1  \register_globals.php on line 7

If register global is o , then i know using print_r($_POST['txt_name']) ,

But now register global is On(1) ,

How to get text field value ,

Advise

+1  A: 

Why is there a + symbol in the variable name? It should be just print_r($txt_name);.

casablanca
thanks, genrally people saying , in the security perpective register global on is dangerous , can u tell me , Why dangerous ,How hacker insert malicious values,
Bharanikumar
This is because somebody can pass values to your script like this: `index.php?name=something`. If you actually happen to use `$name` as a variable in your program and you forget to initialize it, you will end up with whatever value the user passed in.
casablanca
yes, but u see this problem will occur on GET method not an post method am correct ?
Bharanikumar
It has nothing to do with the method, you don't even need a form submission for this to happen. The user can simply append `?variable_name=value` to any URL.
casablanca
... or add it to a form, or add it as a cookie.
Charles
A: 
If register global is o , then i know using print_r($_POST['txt_name']) ,

But now register global is On(1) ,

How to get text field value ,

To directly answer the question as posed: All register_globals does is create a copy of every GPC value submitted as global. The $_POST, $_GET, $_REQUEST and $_COOKIE arrays do not go away.

Charles