Discussions of secure PHP coding. Security in software is important, so don't be afraid to ask. And when answering: be anal. Nitpick. No security vulnerability is too small.
Below is a very simple example of what I am doing. Essentially I have a "front controller" which validates an incoming http get request against a white list. The http request is a file that should be included. If it is valid, the request is stored in a registry. Once it is stored in the registry, an instance of another class is called - that class is responsible for including the validated request (which is now stored in the registry). Aside from some abstraction that may seem complete useless in my code below, is it safe to use data stored in the registry (which is a valid http request) to include the file? I cannot see anything wrong with it even though Zend Studio is complaining about an "unsafe use of variable in call include()/require()." I just think thats because Zend Studio does not know where the variable is coming from.
// use a config object to load the configurtion
$config = new Config_Ini('/path/to/config.ini'); // or XML or DB or whatever
$config->valid_files = array("myfile" , "yourfile" , "foo" , "bar"); // or set it directly
// somewhere later do something like
$fc = new FrontController($request, $config);
$fc->dispatch();
arborint wrote:I would recommend not using globals wrapped in globals
By globals wrapped in globals I am assuming you mean an http request wrapped in a singleton? This was a concern of mine, but if the data is properly validated, I cannot think of a reason not to use it. I am interested to know why you would not recommend it.
Why use a singleton to store nothing but a simple config value???
Your code was extremely confusing to me...so while it might make sense to you now...in 9 months time you'll be scratching your head wondering what the hell.
Oh. I completely concur with your point. The code above was just an example, not my actual implementation, hence the "aside from some abstraction that may seem complete useless in my code below."