php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #53767 $_GET variable not created if query string contains %00
Submitted: 2011-01-17 14:45 UTC Modified: 2011-01-17 16:43 UTC
From: bjorn dot brandewall at gmail dot com Assigned:
Status: Not a bug Package: Apache related
PHP Version: 5.3.5 OS: gentoo-r4 #3
Private report: No CVE-ID: None
 [2011-01-17 14:45 UTC] bjorn dot brandewall at gmail dot com
Description:
------------
(I'm using PHP Version 5.3.4, but that one wasn't in the list...)

Consider the following query string:
/test.php?A=1&B=hello%00&C=3

This will generate the $_GET (and $_REQUEST) array:
(
  'A'=>1,
  'C'=>3
)

As you can see, B isn't included above. That's because the string contains '%00'. This looks like a bug to me.

Sure, NULL characters are not common, but they should be valid, shouldn't they? In this case I produced the string ending with '%00' by running urlencode() on an mcrypt():ed string. "%95do%AFZF%ED%F6%C3%22%25%FC%00", if you're interested.


Test script:
---------------
n/a

Expected result:
----------------
$_GET and $_REQUEST should look like this (replace 'NULL' with actual NULL character):
array(
  'A'=>1,
  'B'=>'HelloNULL',
  'C'=>3
)


Actual result:
--------------
$_GET and $_REQUEST look like this:
array(
  'A'=>1,
  'C'=>3
)


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-01-17 16:43 UTC] rasmus@php.net
-Status: Open +Status: Bogus
 [2011-01-17 16:43 UTC] rasmus@php.net
Unable to reproduce.  Probably running some non-standard PHP code that is doing 
this.
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Thu Jun 17 08:01:24 2021 UTC