Quote:
quote:Originally posted by natmaster
i didn't know there was a difference.... i just started learning php and have a background with C/C++ so i'm used to doing stuff like that. :) unfortuneatly i didn't really understand what you were saying about it...could u explain that a bit more? i like to fix bad habbits before they become habbits.
|
Definitely. If you try to use a non-existent variable, PHP will CREATE that variable for you, automatically. PHP will also issue a NOTICE level warning (the lowest severity level), which many people have disabled by default.
For example, take this simple script:
Code:
<?php
echo "Hello, " . $name;
?>
Obviously, $name doesn't exist.
Check your error_reporting setting in php.ini. Set it to E_ALL. Run the script. You should get a NOTICE level warning saying that you're using an uninitialized variable.
Change error_reporting to E_ALL & ~E_NOTICE. That's "Everything except E_NOTICE", by the way.
Run the script again. No errors.
In both cases, PHP creates the variable $name and gives it a default value. Since you're using the variable in string context, the variable is treated as an empty string. If you were using it in an integer context, it would be 0. If in a boolean context, it would be false.
The problem with your code is that it won't work on ALL installations of PHP. What happens when you upload your script to an ISP that has error_reporting set to E_ALL? Your pages get displayed with errors, that's what.
Is the existence of that variable really proof enough that it's what you want it to be? No. You're expecting an array. If that variable is set to any other data type, you'll get errors in the foreach() loop.
If register_globals is on, what happens when a malicious user requests your page and tacks on "?_SESSION[firstquarter]=0" to the URL?
See what I'm getting at?
The best way to write your scripts is to set PHP to it's most restrictive configuration -- error_reporting = E_ALL, register_globals = OFF -- and go from there.
Once your site runs cleanly here, it should run cleanly anywhere else, and you've probably made your site much more secure against malicious users trying to hack your site by submitting invalid GET, POST, and COOKIE data.
For more info, I strongly suggest you read my register_globals FAQ from the old lists, and the Security section of the PHP manual online:
http://p2p.wrox.com/archive/beginnin...2002-11/17.asp
http://www.php.net/security
http://www.php.net/security.errors
http://www.php.net/security.registerglobals
Check your error_reporting setting in php.ini.
Take care,
Nik
http://www.bigaction.org/