Warning "Do not Access Superglobal $_POST Array Directly" on Netbeans 7.4 for PHP

Question

I've got this message warning on Netbeans 7.4 for PHP while I'm using $_POST, $_GET, $_SERVER, ....

Do not Access Superglobal $_POST Array Directly

What does it mean? What can I do to correct this warning?

Edit: The Event sample code still shows this warning.

Bersagliere

What's the code that insures this message in Netbeans? – Laborsaving

It is just a recommendation, you can turn it off in the options... and I would say this is not a programming question! – Pagandom

I just want to know what this warning want me to change! because older netbeans version is not showing. Is there another way to get those parameters from? (I mean $_POST) – Bersagliere

@MatteoTassinari I know that is just the recommendation and I know where to disable it, but what I can I do to make correct without any warning? I think my knowledge have limit to get warning, but I just want to fixed it up to make my code up to date with new thing because I know only $_POST will get those posting form submitted. Anyway, Thanks for your comment :D – Bersagliere

possible duplicate of Security concern when accessing php superglobal directly – Dominicdominica

Answer 1

filter_input(INPUT_POST, 'var_name') instead of $_POST['var_name']
filter_input_array(INPUT_POST) instead of $_POST

Plumbic

Are you answering at the question "what does the warning mean" or at the question "how to remove it"? Because I agree with you, that's what the warning means, but using the function the warning stays there. I have it right now on a $name = filter_input(INPUT_POST, $_POST["name"]);. – Siobhan

@Siobhan you are using $_POST again while you should do something like this $name = filter_input(INPUT_POST, "name"); – Isoagglutinin

and what is replacing $_REQUEST ? – Assembly

@Assembly INPUT_REQUEST, in this example filter_input(INPUT_REQUEST, 'request_name') – Leftward

that does not exist... that is the problem – Assembly

Well, the warning may disappear, but if you don't specify a filter then you will not really fix the security issue NetBeans is pointing out. For example, if you are expecting an int, use: filter_input(INPUT_POST, 'var_name', FILTER_SANITIZE_NUMBER_INT) – Phidippides

how do i access $_GET – Highway

-1: This answer seems kind of trivial. no explanation, what filter_input does, not even a link to php.net/filter_input. It frightens me that people will just see it, use it, think they are writing better code but still not understand a thing. – Nita

Ow, suggesting use of a filter function without a filter argument leads to FILTER_UNSAFE_RAW, which is equivalent to TRUST_ALL_BAD_INPUT – Staffan

can you explain , why we should do this? – Theatheaceous

If I am not mistaken, INPUT_REQUEST seems to be not implemented yet: php.net/manual/en/filter.constants.php. – Bennink

You must specify a filter, otherwise this doesn't do anything other than get rid of the warning. Manual says: "If omitted, FILTER_DEFAULT will be used, which is equivalent to FILTER_UNSAFE_RAW. This will result in no filtering taking place by default." – Affectation

Answer 2

Although a bit late, I've come across this question while searching the solution for the same problem, so I hope it can be of any help...

Found myself in the same darkness than you. Just found this article, which explains some new hints introduced in NetBeans 7.4, including this one:

https://blogs.oracle.com/netbeansphp/entry/improve_your_code_with_new

The reason why it has been added is because superglobals usually are filled with user input, which shouldn't ever be blindly trusted. Instead, some kind of filtering should be done, and that's what the hint suggests. Filter the superglobal value in case it has some poisoned content.

For instance, where I had:

$_SERVER['SERVER_NAME']

I've put instead:

filter_input(INPUT_SERVER, 'SERVER_NAME', FILTER_SANITIZE_STRING)

You have the filter_input and filters doc here:

http://www.php.net/manual/en/function.filter-input.php

http://www.php.net/manual/en/filter.filters.php

Lauer

If you do exactly what you say, Netbeans will still underline the "$_POST" or "$_GET" parts and display the notification as if it wasn't being filtered. This problem might just be a Netbeans bug (in version 8.1 at least). – Loser

Replace it with filter_input. You don't use it along side it. – Precatory

Answer 3

I agree with the other answerers that in most cases (almost always) it is necessary to sanitize Your input.

But consider such code (it is for a REST controller):

$method = $_SERVER['REQUEST_METHOD'];

switch ($method) {
            case 'GET':
                return $this->doGet($request, $object);
            case 'POST':
                return $this->doPost($request, $object);
            case 'PUT':
                return $this->doPut($request, $object);
            case 'DELETE':
                return $this->doDelete($request, $object);
            default:
                return $this->onBadRequest();
}

It would not be very useful to apply sanitizing here (although it would not break anything, either).

So, follow recommendations, but not blindly - rather understand why they are for :)

Fabulist

Answer 4

Just use

filter_input(INPUT_METHOD_NAME, 'var_name') instead of $_INPUT_METHOD_NAME['var_name'] filter_input_array(INPUT_METHOD_NAME) instead of $_INPUT_METHOD_NAME

e.g

    $host= filter_input(INPUT_SERVER, 'HTTP_HOST');
    echo $host;

instead of

    $host= $_SERVER['HTTP_HOST'];
    echo $host;

And use

    var_dump(filter_input_array(INPUT_SERVER));

instead of

    var_dump($_SERVER);

N.B: Apply to all other Super Global variable

Totality

and what would be the alternative to if(isset($_POST) && !empty($_POST){ //some code } please. – Willey

Answer 5

Here is part of a line in my code that brought the warning up in NetBeans:

$page = (!empty($_GET['p'])) 

After much research and seeing how there are about a bazillion ways to filter this array, I found one that was simple. And my code works and NetBeans is happy:

$p = filter_input(INPUT_GET, 'p');
$page = (!empty($p))

Coated