php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #55102 add parameter to parse_str to avoid sanitizing of root keys
Submitted: 2011-07-01 09:31 UTC Modified: 2011-07-01 19:02 UTC
Votes:7
Avg. Score:4.9 ± 0.3
Reproduced:7 of 7 (100.0%)
Same Version:3 (42.9%)
Same OS:3 (42.9%)
From: giorgio dot liscio at email dot it Assigned:
Status: Open Package: URL related
PHP Version: Irrelevant OS: Irrelevant
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
48 - 17 = ?
Subscribe to this entry?

 
 [2011-07-01 09:31 UTC] giorgio dot liscio at email dot it
Description:
------------
hi, this is probably an old behavior to make php backward compatible when register_global was enabled

parse_str("hey all=1",$r); ---> array('hey_all' => '1');

parse_str is now widely used in xmlhttprequest communication and may cause a lot of issues and waste of time when debugging because we are not able to know how exactly what type of character sanitizing is made to root keys

yep, only root keys are sanitized because

parse_str("aaa[hey all]=1",$r); ---> array('aaa' => array('hey all', '1'));

works like expected

so my request is not to change the default behavior of this function (and how $_GET $_POST etc are populated)

but add another parameter to this function for who wants root keys parsed without sanitizing

void parse_str ( string $str [, array &$arr ] [, bool $bwcompatible = true])

thank you


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-07-01 19:02 UTC] felipe@php.net
-Type: Bug +Type: Feature/Change Request
 [2011-07-01 19:02 UTC] felipe@php.net
Changing to Feature request.
 [2021-09-09 20:08 UTC] rok dot kralj at gmail dot com
This bug has a neat workaround. Just take the root keys, encode them (so dots and other special characters are hidden), then use parse_str.

You can take the code from here, just attribute it.
https://stackoverflow.com/a/18209799/924109
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 07:01:27 2024 UTC