# E_NOTICE should warn of uninitialized arrays

- Thread: https://externals.io/message/19883
- Original archive: https://news-web.php.net/php.internals/19883
- Started by Jakub Vrana on 2005-11-01T13:37:33+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #19883 — Jakub Vrana — 2005-11-01T13:37:33+00:00

URL: https://externals.io/message/19883#19883

Hello!

 `E_NOTICE` warns of uninitialized variables but doesn't warn of adding
elements to an uninitialized array ($a[] = 5). It is a very similar
problem so `E_NOTICE` should warn of it either.

It's the same bad practice as working with uninitialized variables
with the same security risks and IMHO the programmer should be warned
of it.

There is a bug regarding this topic marked as bogus by Iliia:
http://bugs.php.net/bug.php?id=28151

Is current behavior really expected and wanted?

Jakub Vrana

---

## #19889 — Sharif Ibrahim — 2005-11-01T18:59:36+00:00

URL: https://externals.io/message/19883#19889 · In reply to: #19883

> Hello!
>
> `E_NOTICE` warns of uninitialized variables but doesn't warn of adding
> elements to an uninitialized array ($a[] = 5). It is a very similar
> problem so `E_NOTICE` should warn of it either.
>
> It's the same bad practice as working with uninitialized variables
> with the same security risks and IMHO the programmer should be warned
> of it.
>
> There is a bug regarding this topic marked as bogus by Iliia:
> http://bugs.php.net/bug.php?id=28151
>
> Is current behavior really expected and wanted?
>
> Jakub Vrana
>
> --
> 
> 
>
>

This was brought up about 2 months ago with the additional point that
a notice here can alert one to possible script injections that can
occur when register_globals is on.

A simplistic example:
$auth['user'] = 'foo';
$auth['pass'] = 'bar';
if ($_REQUEST['user'] == $auth['user'] && $_REQUEST['pass'] == $auth['pass'])
{
    // Do something that requires authentication
}

Which is exploitable when register_globals is on by
script.php?auth=123&user=b&pass=b

(http://www.colder.ch/news/09-09-2005/4/another-example-showing-t.html)

Of course register_globals should be off, but many hosts still
stupidly turn it on by default.  Most* other code that is susceptible
to register_globals vulnerabilities will generate an `E_NOTICE` which
helps guard against silly mistakes of forgetting to initialize global
variables, at least.

This particular issue was brought up a year or two back when Sara
submitted a patch to add the notice which was discussed and rejected,
though the interaction with register_globals wasn't mentioned.

While I'd personally like an `E_NOTICE` here, I'm and outsider without
any karma so am just presenting some of the background on the issue.

* Of course it's possible to get rid of the notice while retaining the
register_globals vulnerability by using isset($globalvar) ? $globalvar
: '' but there's an `E_NOTICE` in the normal cases.

 - Sharif