|
|
Posted by Vedanta Barooah on 04/28/05 17:16
the code below was talking of function declarations ... reffer to the thread.
will code injection in case of function declarations work? I am not sure!!
;)
<?php
function add($a,$b,$c){
return $a+$b+$c ;
}
echo add(2,null,3);
# even if you pass the value of $b in the url as a get or post
param... it wont work.
?>
thanks,
vedanta
On 4/28/05, Jason Barnett <jason.barnett@telesuite.com> wrote:
> Vedanta Barooah wrote:
> > btw! saying:
> >
> > add($a=null,$b=null,$c=null)
> >
> > is as good as saying:
> >
> > add($a,$b,$c)
> >
>
> No, it's not. Because in this case $a, $b and $c are all uninitialized
> variables and (if this is a function definition) then you *have* to
> supply $a $b and $c parameters.
>
> Even if you were just calling add() this wouldn't be wise. Consider the
> possibility that your server uses register_globals. In that case I can
> browse to:
>
> http://yoursite.com/yourpage.php?a=25&b=20&c=1234567890
>
> Not to mention the code injection possibilities.
>
> > thanks,
> > vedanta
> >
> > On 4/28/05, Vedanta Barooah <vedanta.barooah@gmail.com> wrote:
> >
> >>Well that was simple, but this is what i am trying to solve:
> >>
> >>if you refer to the php documentation for ldap_open() function it says:
> >>
> >>resource ldap_search ( resource link_identifier, string base_dn,
> >>string filter [, array attributes [, int attrsonly [, int sizelimit [,
> >>int timelimit [, int deref]]]]])
> >>
> >>if you look at the 4th and the 6th arguments to the function
> >>attributes is an array while sizelimit is an int, i want to pass the
> >>sixth element without passing the 4th and the 5th ... how do i do
> >>that??
> >>
> >>i tried these options:
> >>
> >># this does not work,
> >>$rs=ldap_search($con,"o=vodoo.com","(objectClass*)",array(),0,500);
> >>
>
> $rs = ldap_search($con, "o=vodoo.com", "(objectClass*)", null, null, 500);
>
> >># this wont works :((
> >>$rs=ldap_search($con,"o=vodoo.com","(objectClass*)",' ',0,500);
> >>
> >># this also goofs!
> >>$rs=ldap_search($con,"o=vodoo.com","(objectClass*)",NULL,0,500);
> >>
> >>here that 5th arg works if i pass a zero as ... 0 means the default behaviour!!
> >>
> >>any ideas ... clues ?
> >>
> >>Thanks,
> >>Vedanta Barooah
> >>
> >>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
--
*~:~*~:~*~:~*~:~*~:~*~:~*~:~*~:~*~:~*~:~*
Vedanta Barooah
YM! - vedanta2006
Skype - vedanta2006
Navigation:
[Reply to this message]
|