This questions is being asked after having read a few others.
Do not access superglobal $_GET array directly
“Do not Access Superglobal $_SERVER Array Directly” on Netbeans 7.4 for PHP
Why is filter_input() incomplete?
I have loaded up the latest version Netbeans 8.0
and I have seen a warning
Do not Access Superglobal $_REQUEST Array Directly.
Great, I am happy to be shown when I am doing something which can be improved upon, so I look at the hints
.
The suggestion is quite simple.
Use some filtering functions instead (e.g. filter_input(), conditions with is_*() functions, etc.).
So I start looking into fliter_input()
however it is not yet implemented for $_REQUEST
. This seems like a little bit of a dead end.
Then I read something which was quite helpful from (@bobince) "At the start of your script when you're filtering, you don't know where your input is going to end up, so you don't know how to escape it."
It reminded me, I know exactly where my input is going to end up, and exactly what it will be used for. So, I wanted to ask everyone if the approach I am going to take is essentially safe
.
I am designing a REST-ish API and I am using $_SERVER['REQUEST_METHOD'];
to determine the resource which needs to be returned. I am also using $_REQUEST['resource'];
which should contain everything on the URI
after /api/
following the .htaccess rewrite
.
The questions I have about my approach are:
$_SERVER['REQUEST_METHOD'];
to be within the required GET
PUT
POST
DELETE
(which i will need to do anyway), is there really a problem not filteing the input?$_REQUEST['resource'];
by using filter_input (INPUT_GET, 'resource');
? When this will only be used to determine a resource, and where the resource can not be determined (say someone attempts to add malicious code) we will simply not find a resource and return a 404 Not Found
status.I realise, this may seem like a lot of concern for what is only considered a warning however, in my experience, fixing just the errors will give you working code, but fixing the warnings will help you understand why the code works.
So I start looking into
fliter_input()
however it is not yet implemented for$_REQUEST
. This seems like a little bit of a dead end.
I'd say it is not a dead end but on purpose. filter_input()
requires you to clearly specify the input type. $_REQUEST
is not clear about it, it contains input from various sources, allowing one source overwriting another.
Next to that this is also not what the warning precisely wants to tell you. Swapping a superglobal like $_GET
with an equally superglobal function like filter_input(INPUT_GET, ...)
shows the same design flaw. But Netbeans can't warn you as easily about it.
And getting rid of superglobals is already a good idea.
Instead, inject input data to your application at a low-level place, e.g. bootstrapping the request information and do not use any superglobals nor the filter_input
function in the rest of your code.
That will allow you to easily simulate any request method without even having an actual request.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With