I work with php for a few weeks and apologize if the question is so banal and silly. But looking for scrypt php here and know that some prefer to check the values received from a form directly with $_POST while others first move the content of $_POST into the variables and then make the appropriate checks using the variables. From the point of view of security there are differences or does not change anything?

This is an example of scrypt working directly with $ _POST :

if(isset($_POST['test'])) { if(strlen($_POST['test'])>=200) { echo "ok" } else { echo "no!" } }

And this is an example of script working with variables:

if(isset($_POST['test'])) { $test = $_POST['test']; if(strlen($test)>=200) { echo "ok" } else { echo "no!" } }

  • 1
    Nothing changes at all. i – Dan Landberg Sep 6 '17 at 20:42
  • What security problems do you expect? Also, it should be clear that the second way is better style for most applications. – Arminius Sep 6 '17 at 20:53

Your examples fail to illustrate the problem (and also don't follow any standard PHP style I am aware of). You are unlikely to see the problem until you get to over about 100 lines of code.

(I don't get your reference to scrypt).

There are 2 issues this question addresses - that of scope, and that of modifying data. $_POST is a superglobal so the data is always in scope without being explicitly declared in a block. This has certain advantages, e.g. you always know where to find it. But relying on the data you want to process being present in $_POST when writing a method or function means you can't re-use that method for other data.

As long as you ensure you don't change the original value, you can always refer back to the canonical version. e.g. if an error occurs in the processing and you want to log the inputs as well as, say, a stack trace.

The code below would be very bad programming:

foreach ($_POST as $name=>$value) {
   $_POST['name']=mysqli_real_escape_string($connection, $value);

If in doubt, the golden rule is

  • validate input
  • transform output

$_POST, indeed all the superglobals except $_SESSION, are input.

Following conventions and applying good programming practices makes code more manageable, easier to review and bug-resistant therefore less likely to have unexpected side effects (i.e. vulnerabilities).

If you had asked this on, say, Stackoverflow then I expect some wag would have pointed out that dereferencing a superglobal is slower than a local variable. In the same way that spitting in the ocean raises the water level. However even though I think this is a question about Security, I suspect you might get better feedback on a different forum.

  • Unfortunately, my scarce knowledge of English does not help to explain the best I mean but ... wow you've been super bright. Thanks so much :) – J. Doe Sep 6 '17 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.