Security issues when cleaning arrays(in PHP)?

Question

Could someone please explain why $_POST= array(); isn't an effective way of resetting your $_POST superglobal?

I thought of this when reading this question.

Being an array, I would imagine all elements of that array, be it $_POST or any other, would be reset when re-initializing it.

Maybe it's not effective because it prevents you from accessing any form input fields and effectively renders the $_POST useless? — oggy, Oct 23 '09 at 00:05
@oggy: all depends on how you plan on using it. It's your code to type, and your logic to implement. If every action could only be used in 1 single situation, programming and scripting would lose their purpose. You mention only one of thousands of possibilities. — KdgDev, Oct 23 '09 at 00:12

score 3 · Accepted Answer · answered Oct 23 '09 at 00:03

3

You are right, $_POST= array(); is fully resetting $_POST!

The answers in the other post are related to
"how to sanitizing/clean the value(s) of $_POST".

answered Oct 23 '09 at 00:03

powtac

40,542
28
115
170

Ow, a misinterpretation on my part then. – KdgDev Oct 23 '09 at 00:11

score 1 · Answer 2 · answered Oct 23 '09 at 00:05

This line $_POST=array(); does fully reset the $_POST array.

I guess there is a misunderstanding on your side of the referenced question. The goal of that script isn't to empty $_POST but to sanitize the values.

tscully tries to sanitize values in $_POST (because they are user-input) to be able to "safely" use them further when doing DB operations.

That's why he uses mysql_real_escape_string (Escapes special characters in a string for use in a SQL statement).

score 0 · Answer 3 · answered Oct 23 '09 at 00:04

what's exactly your question?

unset($_POST) is resetting the superglobal effectively erasing any values in it.

cross-site scripting is that wide subject you won't be able to do the filter on your own.

check this XSS cheat sheet here: http://ha.ckers.org/xss.html

+more info on developing anti-XSS measures here: http://hungred.com/web-development/solutions-crosssite-scripting-xss-attack/

score 0 · Answer 4 · answered Oct 23 '09 at 00:06

0

As far as I know, that would do it. It should be noted that this only clears out the POST information, not the GET. The question I would have to ask is why?

answered Oct 23 '09 at 00:06

Joanne C

1,115
6
10

Actually, this was all a misinterpretation on my part. I thought that a complete reset was what they were asking for in the other topic. – KdgDev Oct 23 '09 at 00:13

Security issues when cleaning arrays(in PHP)?

4 Answers4