OSDev.org

..

Try this:

chris, isn't it possible to access this variable directly by this way:

<?php
if($action == 'xxx') do_sth();
?>

Not necessarily, if register globals is set to off in the php.ini file, your code that you just put would not only not work, but give errors.

Also your way is more insecure, it opens up the php script to hacking.

Hm ... then I should ask My Web Provider to change this ... or would it suffice to replace direct access to the variables extracted by the server out of http-header/body by $HTTP_GET_VARS['my_var']?

Well as long as you use the $HTTP_POST_VARS, $HTTP_GET_VARS, $HTTP_SERVER_VARS, you won't have to worry about people hacking your software by poisoning the variables.

The reason why $action won't work is because $action could be set up from a post var or server var, even though it is SUPPOSED to come from the get vars. So it is much safer to do it like this.

You guys need to upgrade to PHP 4.1.0.
Then you could use $_GET, $_POST, $_SERVER.

The only reason I told him to use HTTP_GET_VARS, HTTP_POST_VARS and HTTP_SERVER_VARS is because I don't know what version of PHP he has.

I always use $_GET $_POST and $_SERVER in my php scripts, but the code I gave him works better on old and new versions of PHP, well for now anyway, it will be obsolete sooner or later.