dongzi8191 2014-02-20 16:35
浏览 22
已采纳

可以在短时间内传播$ _GET变量吗?

I'm editing a website made form another programmer, i see he uses short php tags <? instead of <?php or <?= instead of <?php echo

is there any way to assign $_GET variabiles in a short way? I see he is using $id instead of $_GET['$id']

i'm changing domain on his website from www.mydomain.com to www.yourdomain.com/folder

The problem brons in this circumstance, in a page with this address:

www.yourdomain.com/folder/foto.php?id=http://www.yourdomain.com/folder/img/imagename.jpg

He retrives the id variable in this way:

foto.php:

<html>
  <head>
    <title></title>
    <meta content="">
    <style></style>
  </head>
  <body bgcolor="Black">
  <?
    session_start();
    include "config.php";
$id=strip_tags($id);
    ?>



  <table  align="center"><tr><td>
<img src="<?=$id?>" align="left" border="0">
</td></tr></table>  
  </body>
</html>

config.php:

<?
$db_host = "??.??.??.??";  
$db_user = "??????";       
$db_password = "?????";   
$db_name = "?????";       

//db connect
$conn = @mysql_connect($db_host,$db_user,$db_password)
or die
("connection error");
$db = @mysql_select_db($db_name,$conn);

?>

But it only works on the old domain, in the new domain it cannot retrive the $id variable!

I know that if i change $id with $_GET['$id'] the problem is solved, but i can't figure out how it can work in the old domain!

Old Domain = PHP 4.4.9

New Domain = PHP 5.3.28
  • 写回答

1条回答 默认 最新

  • dry9192 2014-02-20 16:44
    关注

    That variable is available because the register_globals directive is enabled in php.ini.

    A basic explanation:

    register_globals registers $_REQUEST super global array elements as variables. For example if you submit a value in a form, via POST or GET request methods, with an input field name id, PHP will automatically register a variable $id and assign it value of the input field id.

    This is what you're seeing at your old domain.

    In newer versions of PHP this is disabled by default (and now removed) because it allows anyone to inject variables into your script.

    According to the PHP manual this directive is removed as of version 5.4 but it's been turned off by default for considerably longer.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 如何解决ldsc的这条报错/index error
  • ¥15 VS2022+WDK驱动开发环境
  • ¥30 关于#java#的问题,请各位专家解答!
  • ¥30 vue+element根据数据循环生成多个table,如何实现最后一列 平均分合并
  • ¥20 pcf8563时钟芯片不启振
  • ¥20 pip2.40更新pip2.43时报错
  • ¥15 换yum源但仍然用不了httpd
  • ¥50 C# 使用DEVMOD设置打印机首选项
  • ¥15 麒麟V10 arm安装gdal
  • ¥20 OPENVPN连接问题