Best way to pass string to function ?

Question

What's the best way from security perspective to pass string to a function. I know I can use globals, session and in function string. Like function test($string). What's the best approach ? If any one knows please let me know.

I'm trying to write something like this for example:

$url = 'http://domain.com/';

function test() {
  echo $url;
}

But if possible not using globals or in function strings. As described above.

Perhaps I could use define and defined ?

Answer 1

I got it guys, I used define. Here is example:

define('URL', 'http://domain.com/');

function test() {
  echo URL;
}

But if you any one else knows other ways, please reply.

Answer 2

Oddly enough, I think if you are asking purely from a security perspective, I'd say that using global variables to pass data to functions is best.

"Woah! Are you mental?" I hear you ask?

It's like the idea of abolishing seatbelts, and instead fixing a sharp, 6 inch spike onto all steering wheels instead. That would change your driving behaviour, no? You'd become the world's safest driver overnight!

So, if you forced yourself to use globals as parameters, you'd make sure your function did as much security checking on that data as possible, as you couldn't be sure your caller had taken care of it.

Of course, like the steering wheel spike, this is an utterly ridiculous suggestion. In the real world, you use function parameters wherever possible: easier to test, easier to read, allows recursive calls, etc... A more OO approach might be to use a class which takes the raw data in its constructor, and puts validated data into its member variables for other class methods to use.

Let the downvotes commence :)

Answer 3

Ok, here is another answer I just figured out, which is good enough for me.

define('XML', 'file.xml');

then in function do soemthing like this

function test()
  $xml = simplexml_load_file(XML);
}

This way at least I don't need to change "file.xml" name if I need to in every function :-)

Answer 4

Try yo use $GLOBALS array

function test() {
  echo $GLOBALS['url'];
}

or

function test() {
  global $url;
  echo $url;
}