dongzi8191 2014-02-20 16:35
浏览 22
已采纳

可以在短时间内传播$ _GET变量吗?

I'm editing a website made form another programmer, i see he uses short php tags <? instead of <?php or <?= instead of <?php echo

is there any way to assign $_GET variabiles in a short way? I see he is using $id instead of $_GET['$id']

i'm changing domain on his website from www.mydomain.com to www.yourdomain.com/folder

The problem brons in this circumstance, in a page with this address:

www.yourdomain.com/folder/foto.php?id=http://www.yourdomain.com/folder/img/imagename.jpg

He retrives the id variable in this way:

foto.php:

<html>
  <head>
    <title></title>
    <meta content="">
    <style></style>
  </head>
  <body bgcolor="Black">
  <?
    session_start();
    include "config.php";
$id=strip_tags($id);
    ?>



  <table  align="center"><tr><td>
<img src="<?=$id?>" align="left" border="0">
</td></tr></table>  
  </body>
</html>

config.php:

<?
$db_host = "??.??.??.??";  
$db_user = "??????";       
$db_password = "?????";   
$db_name = "?????";       

//db connect
$conn = @mysql_connect($db_host,$db_user,$db_password)
or die
("connection error");
$db = @mysql_select_db($db_name,$conn);

?>

But it only works on the old domain, in the new domain it cannot retrive the $id variable!

I know that if i change $id with $_GET['$id'] the problem is solved, but i can't figure out how it can work in the old domain!

Old Domain = PHP 4.4.9

New Domain = PHP 5.3.28
  • 写回答

1条回答 默认 最新

  • dry9192 2014-02-20 16:44
    关注

    That variable is available because the register_globals directive is enabled in php.ini.

    A basic explanation:

    register_globals registers $_REQUEST super global array elements as variables. For example if you submit a value in a form, via POST or GET request methods, with an input field name id, PHP will automatically register a variable $id and assign it value of the input field id.

    This is what you're seeing at your old domain.

    In newer versions of PHP this is disabled by default (and now removed) because it allows anyone to inject variables into your script.

    According to the PHP manual this directive is removed as of version 5.4 but it's been turned off by default for considerably longer.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 用C语言输入方程怎么
  • ¥15 网站显示不安全连接问题
  • ¥15 github训练的模型参数无法下载
  • ¥15 51单片机显示器问题
  • ¥20 关于#qt#的问题:Qt代码的移植问题
  • ¥50 求图像处理的matlab方案
  • ¥50 winform中使用edge的Kiosk模式
  • ¥15 关于#python#的问题:功能监听网页
  • ¥15 怎么让wx群机器人发送音乐
  • ¥15 fesafe材料库问题