|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #37040 autoconversion of variable names should be turned off
Submitted: 2006-04-11 13:49 UTC Modified: 2012-07-11 15:21 UTC
Avg. Score:3.6 ± 1.5
Reproduced:3 of 3 (100.0%)
Same Version:2 (66.7%)
Same OS:2 (66.7%)
From: indeyets at gmail dot com Assigned:
Status: Open Package: *General Issues
PHP Version: 5.1.2 OS: FreeBSD 5.4
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: indeyets at gmail dot com
New email:
PHP Version: OS:


 [2006-04-11 13:49 UTC] indeyets at gmail dot com
Currently, PHP does autoconversion of 'dots' in external variable names to 'underscores'. It is documented here:

It does make sense when application has register_globals enabled and prevents losing of incorrectly named variables.

Though, it doesn't make sense when register_globals setting is disabled. In this mode, all external variables are placed inside of associative array, and 'dot' is just as legal for the key-name as 'underscore' is

Reproduce code:
    echo '<a href="'.$_SERVER["SCRIPT_NAME"].'?">test</a><hr>';
    echo '<pre>';
    echo '</pre>';

Expected result:
array(1) {
  string(5) "value"

Actual result:
array(1) {
  string(5) "value"


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2006-04-11 14:09 UTC] indeyets at gmail dot com
to make myself clear:
I propose to turn off substitution of 'dots' with 'underscores' in variable names only for autoglobal-arrays.

Substitution still should be made for registered globals.
 [2012-07-11 14:46 UTC] alastair at propcom dot co dot uk
Since register globals is removed in PHP 5.4, there is no longer any 
justification for this behaviour and it should be removed entirely.

If anyone else comes up with any justification for this behaviour, then that 
justifying factor should be removed because this modifying GET variable names is 
completely out of line.

Not that I'm bitter.
 [2012-07-11 15:21 UTC]
extract() is able to extract directly into the current scope and would break 
without this substitution so it can't be completely removed, but it could be 
isolated to the time of the extract() call I suppose.
 [2012-07-11 15:21 UTC]
-Package: Feature/Change Request +Package: *General Issues
 [2014-09-19 14:32 UTC] hatsebutz at excite dot com
+1 for the proposal of - move that replace-magic downwards to extract (and possible other functions bringing in new variables)
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sat Jul 31 16:01:27 2021 UTC