php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #66976 parse_str does not explain how bad inputs are handled
Submitted: 2014-03-28 21:07 UTC Modified: 2017-01-28 17:02 UTC
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: jakub dot lopuszanski at nasza-klasa dot pl Assigned:
Status: Open Package: Strings related
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
16 + 37 = ?
Subscribe to this entry?

 
 [2014-03-28 21:07 UTC] jakub dot lopuszanski at nasza-klasa dot pl
Description:
------------
---
From manual page: http://www.php.net/function.parse-str
---
The manual does not mention how invalid input (and what is considered as such) will be handled.
As this is probably the only method which can be used to manually parse DELETE or PUT body, I would expect people to use this function in low level code, where it is crucial to know what to expect.
Will it throw exception? Will it set $arr to null? Will it set it to false? Or empty array? Will it simply ignore invalid parts? Will it emit E_WARNING or E_ERROR? What if max_input_vars will be exceeded? What about wrong UTF-8 sequences? How about trailing &, or %?

Btw. why don't you provide $_DELETE and $_PUT arrays is a mystery to me.



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-01-28 17:02 UTC] cmb@php.net
-Package: Documentation problem +Package: Strings related
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue May 21 04:01:35 2024 UTC