php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #29570 phpinfo output inconsistent
Submitted: 2004-08-08 12:47 UTC Modified: 2004-09-04 22:15 UTC
From: grangeway at blueyonder dot co dot uk Assigned:
Status: Not a bug Package: Feature/Change Request
PHP Version: 4.3.8 OS: any
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: grangeway at blueyonder dot co dot uk
New email:
PHP Version: OS:

 

 [2004-08-08 12:47 UTC] grangeway at blueyonder dot co dot uk 
Description:
------------
Bug #24024 discusses the fact that _SERVER["argv"], does not convert html entities e.g. < to &lt; as phpinfo() is a debugging tool, and is marked as bogus.

If this is the case, and content should not be escaped as phpinfo is for debugging, then:
_SERVER["QUERY_STRING"]</td><td class="v">test=&lt;script&gt;alert()&lt;/script&gt;</td></tr>

should not escape < to &lt; and should be consistent with the behaviour of _SERVER['argv'].

At the moment, _SERVER['argv'] and GET['test'] / _SERVER["QUERY_STRING"]</ etc show different representations of the same string, where in reality the value is the same. 



Expected result:
----------------
Ideally All strings should be escaped.

If not (i.e. if this would hinder debugging), then no strings should be escaped so that the output of any string in phpinfo matches the expected value given when running var_dump on the variable.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-09-04 22:04 UTC] rasmus@php.net 
They are all escaped the same way.
 [2004-09-04 22:15 UTC] rasmus@php.net 
In case you don't believe me, try doing:
test[0]=<script>alert("Hello")</script>
and you will see exactly the same non-escaping in GET and QUERY_STRING.  So it is quite consistent in that array elements are not escaped when displayed.  I may fix that, but it still doesn't change the fact that phpinfo() is a debugging function whose very content is insecure.  XSS is the least of your problems if you expose this output to the world.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Jul 12 05:01:33 2025 UTC