Test server does not pass vars from PHP to PHP

[mvhall]

Hi guys,
The tutorial IL26 does work when I upload to my site, but not on my test server. I have installed Apache 1.3.27 with PHP 4.3.1 on W2K locally.
The value remains in the php, but does not get passed to the next php (middle.php).
I must have configured something wrong although followed the instructions to the dot , or forgotten something. <?php phpinfo();?> works, and apache is started as a server. All other php functions (well the ones I've tried) seem to work ok, just not the passing of vars.

Anyone any clues??????

[freddycodes]

How are you testing this? I assume that your remote server is running a different setup than your test server.

I am gonna make a guess based on experience as we have no code to see. But you appear to be running 4.3.1 on your test server and by default register_globals is set to off by default. So you would need to access your variables through $_GET and $_POST array depending on how the vars were passed to the next page. For instance a link is clicked with something like page2.php?var1=foo

To access var1 you would need to access it as $_GET['var1']

[CyanBlue]

Yes... That register_globals is my first guess too...

I am sure there is gotta be reason why they have set it to off in the first place, but I do not know much of PHP to talk about it... What I do is to set it back on from PHP.ini within my Windows directory to get things going... As I was saying, I do not know if it is a good practice or not, but that solved my problems at least for the time being...

If things are not working, post your code so that people, probably freddycodes :D, can take a look at and see what the problem is... ;)

Welcome to the world of PHP... You are in deep trouble... :p

[freddycodes]

The reason is pretty simple, PHP was one of the only languages that was so loosely typed, where every variable coming from wherever was basically in the global scope, you won't find another language like that. It is considered bad practice to most of the hardcore programmers to not know where a variable is coming from.

Hence the $_GET and $_POST arrays which came about in 4.2 I think. It used to be HTTP_POST_VARS and HTTP_GET_VARS, obviously since they were gonna push people to refer to the variables from where they came from they decided to shorten the array name.

You should keep the register_globals off and instead start to train yoursefl to do things properly and thatis to call the variables from where they came from.

[mvhall]

Hi guys,
Well I thought I would start the easy way and try one of the great tutorials here (intermediate level no 26). I have not changed anything on that code, but I'll check the variable setting later tonight. I am quite new to PHP and am glad you did respond so quickly. Out of the top of my head I think the variable is passed with getURL("middle.php", "_blank","GET") on a button action. The middle.php will just try to show the passed value with <? php echo $value ?> . That's all, even I thought to understand it. The url on the addres bar does show: " http://localhost/middle.php?value=foo "

So just out of curiosity, what would the code be to show where it was comming from? <?php echo $_GET["value"] ?>.
I did notice before that there was a difference between $HTTP_GET_VARS and $_GET in some of my tests. Is that possible?
Thanks,

[mvhall]

Just tested the settings with phpinfo(), and you were right the remote site it is set on, and my local settings are off. Still with $_GET it should work shouldn't it?

[CyanBlue]

I just tried the code and it is working fine as you have said...

I have turned register_globals off, and this is the script that I have used <?php echo $_GET['value']; ?> to get it working...

Let me know...

[mvhall]

Can't get it to work with echo <?php $_GET['variable'] ?>. Never mind with the global switched on it works fine and as it's just for testing locally, who cares. Thanks for replying.

[CyanBlue]

So... It's working now???

Welcome to the hellhole... :D

[freddycodes]

Well one thing to keep in mind is good practice makes for more better coding skills. Using register_globals is sloppy, PHP is the only language that allows it, and it should be noted that the newer versions turn it off by default.

Also consider this.


<?php
if($submit)
{
print $foo."<p></p>";
}
?>
<htmL>
<head>

</head>
<body>
<form action="<?php print $_SERVER['PHP_SELF']; ?>?foo=Gotcha" METHOD="POST">
Name: <input type="text" name="foo" /><br />
<input type="submit" name="submit" value="Submit" />
</form>
</body>
</html>


Run that php script, you'll see that foo is the name of a text field in a form. With register globals turned onn, I can overwrite the value of foo by adding a url parameter, because PHP uses the following variable order again by default.

EGPCS
Env, Get, Post, Cookie, Server

So variables in the Get scope will orverride variables of the same name in the Post Scope. You see the problem with this, your data is not secure and open to vunerabilities.

However by simply using


<?php
if($_POST['submit'])
{
print $_POST['foo']."<p></p>";
}
?>
<htmL>
<head>

</head>
<body>
<form action="<?php print $_SERVER['PHP_SELF']; ?>?foo=Gotcha" METHOD="POST">
Name: <input type="text" name="foo" /><br />
<input type="submit" name="submit" value="Submit" />
</form>
</body>
</html>


You take that vulnerability out of the equation. Because you know where the variable foo is coming from.

I hope that sheds a bit of light on why it is so important to leave register_globals off.

[mvhall]

Hi Freddycodes,
Yep it certainly does. Have you ever thought writing a tutorial on this???? It would help a lot of people I think!

It doesn't explain why I can't get it to work in my test environment with register_globals switched off though.
I will try and code more accurate now I've seen what you meant.
Keep up the good work for the rookies like me.
Thanks

[freddycodes]

Hey no problem, I come from a PHP background and have just been doing flash for about a year. Anyways I did notice, you use


<?php $_GET['variable'] ?>


You actually need to do soemthing with it like print it.


<?php print $_GET['variable'] ?>


Also in your original post you usedvalue not variable, I suppose that was just to show the use of some variable regardless of the name.

Also you asked earlier about the difference between $HTTP_GET_VARS and $_GET

$HTTP_GET_VARS is deprecated as of 4.2 I believe and is still valid for backward compatibility only.

[mvhall]

Yes I meant to use <?php echo $_get['varsomething'] ?>
The only difference between echo and print is the latter can only print one string isn't it?
Hey what about that tutorial? If you need a reviewer, I'm your rookie and quite happy to help.
It's great this forum has people like you, as it really combines various specialties. Well it has helped me a lot anyway.
Cheers.

[freddycodes]

Hey one point of note, $_get and $_GET are different, variable names are case-sensitive, I am sure it was just an oversight.

As for the tutorial, I have a hard enough time getting my thoughts from my brain to the screen in the forums. I have such a hard time writing out lengthy tutorials, I think my contributions in the forums outweigh what I could come up with in the form of a tutorial.

[CyanBlue]

I think my contributions in the forums outweigh what I could come up with in the form of a tutorial.Couldn't agree more... and thank you for all your help in the forum... Really appreciated it... ;)

[freddycodes]

:D I enjoy it!

[CyanBlue]

I'm glad you do... :D