$_SESSION $_POST

[mammothman42]

hi

i've got a basic user register form, action="POST". in my php code (on
the same page, i store the $_POST stuff to a $_SESSION if the user
screws a field up so they don't have to reenter all their info. But
i'm thinking, why should i use $_POST at all if i can just us the
$_SESSION array? or maybe even vice versa? or am i doing this all the
wrong way?

cheers
dave

[Simon Stienen]

<ma**********@h otmail.com> wrote:

things making a bit of sense now.

simon, what exactly is a *very* bad idea? using merge? or using POST in
general? bit lost on that one sorry.

cheers
dave

Sorry -g-
Writing the unckecked POST data directly into the session.
If you *need* to do so, take a special variable, for example:
$_SESSION['post_data'] = $_POST;
--
Simon Stienen <http://dangerouscat.ne t> <http://slashlife.de>
»What you do in this world is a matter of no consequence,
The question is, what can you make people believe that you have done.«
-- Sherlock Holmes in "A Study in Scarlet" by Sir Arthur Conan Doyle

[mammothman42]

hang on i just realised i don't need to use sessions at all! i just set
the values of each field to $_POST[name, user, etc], instead of storing
it in a session and setting them to $_SESSION[name etc]. Or was this
never suggested for a good reason I'm blatantly missing?

[Geoff Berrow]

I noticed that Message-ID:
<10************ **********@h37g 2000oda.googleg roups.com> from
ma**********@ho tmail.com contained the following:

hang on i just realised i don't need to use sessions at all! i just set
the values of each field to $_POST[name, user, etc], instead of storing
it in a session and setting them to $_SESSION[name etc]. Or was this
never suggested for a good reason I'm blatantly missing?

One assumed you had a reason... :-}

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Markus Ernst]

Simon Stienen wrote:

Markus Ernst <derernst@NO#SP #AMgmx.ch> wrote:

// This puts the post data at the end of the $_SESSION array:
$_SESSION = $_SESSION + $_POST;

// As an alternative, this will overwrite already existing entries
with the same keys in the session data:
$_SESSION = array_merge($_S ESSION, $_POST);

But usually you will not want this, as you want to process the
posted data rather than store it into the session.

This is a *VERY* bad idea. Imaging you use user based rights
management... Everyone could simply send a form with one of the
fields: <input name="admin" value="1"> // flag based user management
<input name="userid" value="1"> // user management by user id
// (auto_increment assumed, therefore 1, not 0)
<input name="user" value="admin"> // user management by user name

Right - I did not mean to recommend that procedure (as I mentioned). If for
any reason somebody would do it like that anyway, precautions could help,
such as using uncommon names for the rights management relevant session
variables, such as $_SESSION['cold_beer'] or $_SESSION['ht8Uz6']. So hacking
it via postdata would require exact knowledge of the application.

--
Markus

[mammothman42]

it's all starting to fall into place now! i'm curious though as what
can be hacked these days. How exactly does a hacker forge a header to
fake POST data? How do they send SESSION values to my server? It's all
slightly disconcerting.

cheers
dave

[Simon Stienen]

<ma**********@h otmail.com> wrote:

How exactly does a hacker forge a header to fake POST data? How do they
send SESSION values to my server?

Read RFC 2616 for that. :)
Forged data is nothing else but a normal request with self chosen data for
GET-, POST- and Cookie-variables.

Btw.: "Faking" POST data is not complicated: Just write your own form, fill
it and send it.
--
Simon Stienen <http://dangerouscat.ne t> <http://slashlife.de>
»What you do in this world is a matter of no consequence,
The question is, what can you make people believe that you have done.«
-- Sherlock Holmes in "A Study in Scarlet" by Sir Arthur Conan Doyle