Re: [PHP] $_POST vs $_REQUEST

On 02/22/2010 10:37 PM, Michael Shadle wrote:
> On Mon, Feb 22, 2010 at 1:30 PM, David Murphy<[email protected]>  wrote:
>> Richard,
>> The use of $_REQUEST it no more a security hole than $_GET or $_REQUEST,
>> they should ALL be treats as bad data until normalized and sanitized.  The
>> claim that it opens a security hole  is  just false, that’s like saying PHP
>> is insecure, its not it just allows for lazy coding such as $_REQUEST.

> It represents a way for people to exploit coders who don't know any better.
> Expecting a cookie value to come through in $_REQUEST but you could
> override using a query string parameter makes for easy exploitation.

And how is this more secure? I can create a cookie, send post or get on 
my client machine and send anything I want to the server. Just because 
you are getting a cookie does not mean that you created it :)

So you might as well use request because the data can not be trusted 
either way.

-- 
John
Gerechtigkeit entspringt dem Neid; denn ihr oberster Grundsatz ist: 
Allen das Gleiche.
[Walther Rathenau]