php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #65252 Input string parsing - allow ' ' and '.' chars as hash key
Submitted: 2013-07-12 13:33 UTC Modified: 2021-02-08 14:25 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: matti dot jarvinen at nitroid dot fi Assigned:
Status: Suspended Package: URL related
PHP Version: master OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
35 - 8 = ?
Subscribe to this entry?

 
 [2013-07-12 13:33 UTC] matti dot jarvinen at nitroid dot fi
Description:
------------
Since register_globals has been removed in PHP 5.4.0 there should be no reason other than legacy why input variables ($_POST, $_GET, $_FILES, $_COOKIE, $_REQUEST) can not have keys containing following characters

chr(32) ( ) (space)
chr(46) (.) (dot)

Documentation states that only . is changed to _ but same goes for above characters.

http://www.php.net/manual/en/language.variables.external.php

Test script:
---------------
<form method="POST">
<input type="text" name="foo bar" value="spaced" />
<input type="text" name="foo.bar" value="dotted" />
<input type="submit" value="send" />
</form>

<?php

if(isset($_POST))
{
  print_r($_POST);
}

?>

Expected:
array(
  "foo bar"=>'spaced',
  "foo.bar"=>'dotted'
);

Actual result:
array(
  "foo_bar"=>'dotted'
);


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-07-19 22:59 UTC] yohgaki@php.net
-Summary: Input string parsing +Summary: Input string parsing - allow ' ' and '.' chars as hash key -PHP Version: 5.4.17 +PHP Version: master
 [2013-07-19 22:59 UTC] yohgaki@php.net
This may break apps, but request is debatable.
 [2013-11-23 15:07 UTC] dan dot lugg at gmail dot com
I'd like to second this report/request. With register_globals having been deprecated and removed quite some time ago now, it would be great to see some of the accommodations made for that feature cleaned up.

While it is perfectly understandable that this could cause BC breaks, an INI flag would certainly fix this.

; Can be set to "" to prevent 
; replacement altogether
form_char_replace=". "
 [2021-02-08 14:25 UTC] cmb@php.net
-Status: Open +Status: Suspended
 [2021-02-08 14:25 UTC] cmb@php.net
This topic comes up in internals discussions from time to time.
Unless someone pursues the RFC process[1], nothing will change. :(

[1] <https://wiki.php.net/rfc/howto>
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Apr 16 19:01:31 2024 UTC