Comments on: Why PHP’s $_REQUEST is dangerous

By: Christian Sciberras

Christian Sciberras — Fri, 16 Jul 2010 22:54:16 +0000

Jeremy did you even read the article? Spyros is wrong, but so are you.

The author specifically said that $_REQUEST is only insecure because of $_COOKIE in request_order, which for your information, has been disabled for quite some time.

So to sum it up, $_REQUEST, is a very useful feature which is best used with newer versions of PHP.

There are no other ulterior “major security risks”.

By: Jeremy Simkins

Jeremy Simkins — Wed, 26 May 2010 16:19:58 +0000

I make it a point to never use $_REQUEST. Even studying for the ZCE explains that $_REQUEST is a major security risk. Spyros, you are completely wrong.

Thanks for the article, very useful information. Let’s hope people learn from this…

By: php mail() validation

php mail() validation — Wed, 12 May 2010 08:22:43 +0000

[...] $_COOKIE as usual. I found a nice text explaining why $_REQUEST has a problem, so read for example Why PHP’s $_REQUEST is dangerous – Devlog and see what the problem really is, and how you can avoid the problem. [...]

By: Useful Security Pages | Toby's Development Blog

Useful Security Pages | Toby's Development Blog — Wed, 05 May 2010 08:43:09 +0000

[...] Why $_REQUEST is dangerous [...]

By: Toby

Toby — Wed, 05 May 2010 07:42:29 +0000

Cheers for the explanation, my php.ini was clean but it is a good thing to be looking out for.

I have seen a lot of code floating about that would check against $_REQUEST using if(isset($_REQUEST['wibble'])), just calling the script with script.php?wibble=y will trigger this even if it is a $_POST variable that should be being checked.

By: Christopher Nadeau

Christopher Nadeau — Fri, 30 Apr 2010 21:44:54 +0000

Did you not read the article at all? The fact that cookie data takes *precedence* in $_REQUEST over the others is the dangerous part. Indeed, even if it was last, it would still be dangerous for the simple fact that a specific value would could always be set. No one wants to remove $_REQUEST itself from PHP. Only cookie data should be removed. In PHP 5.3 we have the 'request_order' php.ini setting which has cookies disabled by default:

request_order Note that the default distribution php.ini files does not contain the 'C' for cookies, due to security concerns.

By: Spyros

Spyros — Tue, 27 Apr 2010 17:29:30 +0000

Well, no..

There is absolutely no security problem with using $_REQUEST. Getting input from cookie is the same as getting input from get or post.

If $_REQUEST was indeed a security flaw in PHP, it would have been removed.