I’m not agree with “Any cookie ever set on a users machine will always override any GET or POST data — creating “sticky” variable data”

Because in php.ini
variables_order = “GPCS”(wrt php 5.2.8)

So GET/POST form value never ever be overwritten by Cookie.

Thanks,
Sachin Pethani

“If an attacker some how managed to set a cookie — perhaps through some Javascript injection …”

Sounds like you have bigger issues on your hands if this happens. Lock down your user content and you won’t have this problem or the other hundreds of malicious injections, many much worse than a simple prevention of use of your site.

It’s true that all user data is fundamentally untrustable.

However, the thinking in your message is all about protecting the server from compromise. That’s not the issue here. The issue here is protecting users from abuse.

Allowing cookie data to mingle with form data doesn’t change the vigilance that is necessary in order to prevent your server from compromise.

However, it does make it easier for miscreants to trick unwitting users into unwittingly performing actions on your server which they are nominally allowed to do but might not have chosen to.

So there is no true point in removing C from GPC, because all three arrays are ultimately user-controlled and have to be dealt with! Changing its priority makes much more sense in my opinion -> CGP. You´ll just fix some possible bugs either way, but there´s always a risk to deal with when dealing with user-controlled variables – no matter where they come from.

The author specifically said that $_REQUEST is only insecure because of $_COOKIE in request_order, which for your information, has been disabled for quite some time.

So to sum it up, $_REQUEST, is a very useful feature which is best used with newer versions of PHP.

There are no other ulterior “major security risks”.

Thanks for the article, very useful information. Let’s hope people learn from this…