# register globals -> PHP6 still replaces . in variables from outside - Thread: https://externals.io/message/35774 - Original archive: https://news-web.php.net/php.internals/35774 - Started by Sebastian on 2008-02-24T20:05:31+00:00 - Messages: 9 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #35774 — Sebastian — 2008-02-24T20:05:31+00:00 URL: https://externals.io/message/35774#35774 hi, PHP6 still replaces "." with an underscore in variables from outside. this is an old behavior forced by register globals so i would say its a bug since "." is valid in array keys. for sample: call a script like http://www.example.com/?my.var=1 now $_GET will look like this: Array ( [my_var] => 1) Thanks --- ## #35775 — Scott MacVicar — 2008-02-24T20:12:55+00:00 URL: https://externals.io/message/35774#35775 · In reply to: #35774 The old behaviour would have to remain as well as anything new as it isn't easy to simply change your script. You'd need to track down all your input and change any references of x.y to x_y to ensure you don't break anything. Scott Sebastian wrote: > hi, > > PHP6 still replaces "." with an underscore in variables from outside. this > is an old behavior forced by register globals so i would say its a bug since > "." is valid in array keys. > > for sample: > > call a script like http://www.example.com/?my.var=1 > > now $_GET will look like this: > > Array ( [my_var] => 1) > > Thanks --- ## #41856 — Mark van der Velden — 2008-11-11T21:10:24+00:00 URL: https://externals.io/message/35774#41856 · In reply to: #35774 Sorry for bringing an old thread back to life, but imo this needs some more attention. Sebastian wrote: > hi, > > PHP6 still replaces "." with an underscore in variables from outside. this > is an old behavior forced by register globals so i would say its a bug since > "." is valid in array keys. > > for sample: > > call a script like http://www.example.com/?my.var=1 > > now $_GET will look like this: > > Array ( [my_var] => 1) > > Thanks > It's a valid HTML input name attribute character [1] and imo the replacement feature (where ' ' and '.' characters are replaced to '_') should be removed in PHP 6, when the register_globals feature is removed. There will be PHP applications that need changing, but I estimate that it will be fixed easily. And since PHP 6 is breaking a lot anyway, what other version would be more suitable to change this. [1] - http://www.w3schools.com/TAGS/att_input_name.asp - Mark --- ## #41858 — Davey Shafik — 2008-11-11T22:05:35+00:00 URL: https://externals.io/message/35774#41858 · In reply to: #41856 > Sorry for bringing an old thread back to life, but imo this needs some > more attention. > > > Sebastian wrote: > > […] > > It's a valid HTML input name attribute character [1] and imo the > replacement feature (where ' ' and '.' characters are replaced to '_') > should be removed in PHP 6, when the register_globals feature is > removed. > > There will be PHP applications that need changing, but I estimate that > it will be fixed easily. And since PHP 6 is breaking a lot anyway, > what > other version would be more suitable to change this. > > > [1] - http://www.w3schools.com/TAGS/att_input_name.asp > > > - Mark Not to be pedantic, and really, it further supports your case, the W3C spec for HTML, specifies that the name attribute is simply CDATA, therefore anything is valid. It also says it's case-insensitive also, however I doubt that could be handled in any non-impactful way. - Davey --- ## #41859 — Kalle Sommer Nielsen — 2008-11-11T22:13:09+00:00 URL: https://externals.io/message/35774#41859 · In reply to: #41856 Hi Mark 2008/11/11 Mark van der Velden : > Sorry for bringing an old thread back to life, but imo this needs some > more attention. > > > Sebastian wrote: > > […] > > It's a valid HTML input name attribute character [1] and imo the > replacement feature (where ' ' and '.' characters are replaced to '_') > should be removed in PHP 6, when the register_globals feature is removed. > > There will be PHP applications that need changing, but I estimate that > it will be fixed easily. And since PHP 6 is breaking a lot anyway, what > other version would be more suitable to change this. I don't see it would work with something like import_request_variables() unless thats removed or `extract()`, which is some of the reasons for this replacement feature afair. > > > [1] - http://www.w3schools.com/TAGS/att_input_name.asp > > > - Mark > > -- > > > > -- Kalle Sommer Nielsen --- ## #41861 — Stan Vassilev | FM — 2008-11-12T02:57:55+00:00 URL: https://externals.io/message/35774#41861 · In reply to: #41859 > I don't see it would work with something like > import_request_variables() unless thats removed or `extract()`, which is > some of the reasons for this replacement feature afair. > There was never a need for the replacement to occur for the GPC superglobals. If import_request_variables() needs it, it can do it there only for that import. I.e. $_GET['foo.bar'] is just fine, and importing 'foo.bar' with the above function could still produce $foo_bar only for that specific edge case. It's just a premature replacement too early the stack. Regards, Stan Vassilev. --- ## #41863 — Hannes Magnusson — 2008-11-12T07:24:39+00:00 URL: https://externals.io/message/35774#41863 · In reply to: #41861 > > […] > > There was never a need for the replacement to occur for the GPC > superglobals. Isn't that fixed already? I could have sworn seeing a commit from Ilia that allowed dots in the superglobals (duplicating the key, one with dot and one with underscore) some months ago...? -Hannes --- ## #41865 — Mark van der Velden — 2008-11-12T07:34:38+00:00 URL: https://externals.io/message/35774#41865 · In reply to: #41863 Hannes Magnusson wrote: > > > […] > > Isn't that fixed already? > I could have sworn seeing a commit from Ilia that allowed dots in the > superglobals (duplicating the key, one with dot and one with > underscore) some months ago...? I do did read some code related to that, but I got the feeling that was purely for unicode related matters and I still see replacements. But perhaps I'm reading it wrong. If it has been changed, that would be excellent and it would be great if the documentation got an update also ( http://php.net/register_globals ) I was working on a patch, but I can't get PHP 6 compiled atm (tokenizer.c 'yycINITIAL' re2c v 0.13.5) > > -Hannes > - Mark --- ## #41866 — Stan Vassilev | FM — 2008-11-12T08:56:42+00:00 URL: https://externals.io/message/35774#41866 · In reply to: #41863 > On Wed, Nov 12, 2008 at 03:57, Stan Vassilev | FM > wrote: > > […] > > Isn't that fixed already? > I could have sworn seeing a commit from Ilia that allowed dots in the > superglobals (duplicating the key, one with dot and one with > underscore) some months ago...? > > -Hannes It's not fixed, if it was, it was not checked in. In the 5.3 nightly, foo.php?a.b.c = 10 shows up as $_GET['a_b_c'] in PHP Regards, Stan Vassilev