Re: Self-referencing form action

Beauregard T. Shagnasty wrote:
Scott Johnson wrote:

Beauregard T. Shagnasty wrote:
6. action="<?php echo $_SERVER['SCRIPT_NAME']?>"

// prevent XSS insertion
$sanitized=htmlentities($_SERVER['SCRIPT_NAME']);
7. action="<?php echo $sanitized; ?>">
['SCRIPT_NAME'] may or may not work, it is not guaranteed.
['PHP_SELF'] will always work.

So far, SCRIPT_NAME has worked fine on any hosts I use. What would cause
it to fail?

As far as the XSS insertion I am not familiar enough with that to
comment.

Neither do I; it is just what the knowledgeable person said. :-)


SCRIPT_NAME is not a native PHP variable, and won't be available if it is not implemented on the web server (I think it is a CGI engine thing, can't remember) I know a while back I had an issue and found it not to be 100%. Things might have changed.

I am pretty sure it will be a good chance that it is implemented, but I just like the odds the other way.

.

Relevant Pages

  • Re: Retrieving Date & Time from a web server (localhost)
    ... to retrieve Date & Time from a web server, ... but firstly I need to to test it on my PC, with "localhost" ... Any attempt fail. ... but if I locally tested it, writing "localhost", ...
    (microsoft.public.dotnet.framework.aspnet)
  • Retrieving Date & Time from a web server (localhost)
    ... to retrieve Date & Time from a web server, ... (all IIS http and ftp tasks regularly work) ... Any attempt fail. ... using this VB Net command ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Self-referencing form action
    ... // prevent XSS insertion ... SCRIPT_NAME has worked fine on any hosts I use. ... it to fail? ... That's also a potential problem ...
    (comp.lang.php)
  • looking for a fail over system
    ... MY web server just died and It's taking some time to get back up. ... I want to find a fail over device so when one computer dies another automatically takes over. ... of course letting me know this happened would be a good thing too. ...
    (freebsd-questions)
  • Re: Self-referencing form action
    ... Beauregard T. Shagnasty wrote: ... i.e. a form and handler on the same page. ... As far as the XSS insertion I am not familiar enough with that to comment. ...
    (comp.lang.php)