Menu
Is free
registration
home  /  ON/ PHP _SELF on the form's action attribute. Abulia Abazia mcp php action

PHP _SELF on form's action attribute. Abulia Abazia mcp php action





MCP Fusion ™ Photoshop Actions set combines the most
versatile and convenient action sequences with beautiful color
and black and white conversion.
MCP Fusion ™ includes 56 powerful Photoshop actions,

Below I provide a translation (without correction) with description pages :

MCP Fusion ™ includes 56 powerful Photoshop actions,
to help you achieve the artistic image you desire!

21 sequence colors: with one click
Color as the basis of all color actions, you have a reliable,
efficient workflow in every action.
Color Fusion mix and match actions let you combine
color plays for endless variations.

Eight black and white worker actions: one click B&W,
as the basis of all black and white actions, you have a solid workflow
in every action. B&W Fusion mix and match actions give
you the ability to combine black and white for limitless combinations.

Seven exposure corrective actions: help with glare,
shadows and the overall luminosity of the image.

13 special effect amplifiers: including real action
sunflare and pendulum color setting, toning action.

Seven contrast and sharpening actions: for print and
web with options to apply the results selectively.

This article details the use of the PHP _SELF variable.

What is PHP _SELF variable?

PHP variable _SELF returns name and path to current file(relative to the document root). You can use this variable in the form's action attribute. There are also some nuances that you should be aware of. We, of course, cannot ignore these nuances in any way.

Let's take a look at some examples.

Echo $ _SERVER ["PHP_SELF"];

1) Suppose your php file located at the following address:

Http://www.yourserver.com/form-action.php

In this case, the PHP _SELF variable will contain:

"/form-action.php"

2) Suppose your php file is located at this address:

Http://www.yourserver.com/dir1/form-action.php

PHP _SELF will:

"/dir1/form-action.php"

PHP _SELF on form's action attribute. Why was she needed there?

Usually PHP variable _SELF is used in action attribute form tag. The action attribute specifies the address to which the content of the form will be sent after confirmation (user clicks on the button with type = "submit"). As a rule, this is the same page from which the form left.

However, if you rename the file referenced by the form, you will need to rename the file name in the action attribute, otherwise the form will not work.

The PHP _SELF variable will save you unnecessary corrections, since the page address will be generated automatically based on the file name.

Let's say you have a file with a form form-action.php and you want the form to be submitted to the same file after confirmation. Usually they write like this:

But you can use PHP variable _SELF instead of form-action.php. In this case, the code will look like:

" >

Code for form-action.php

Let's combine the script with the form:

$ name"; echo"
Youcanusethefollowing form again to enter a new name. ";)?> ">

The code at the top of the HTML page will be executed first. The first line of code checks whether the form has been submitted or not. If $ _POST ["submit"] exists, then the IF construct is executed (TRUE) and the name entered by the user will be displayed.

If the $ _POST ["submit"] variable does not exist, then the form has not been submitted and, accordingly, the IF construct will not be executed (FALSE). Therefore, the username will not be displayed.

Bad points related to PHP _SELF variable

The PHP variable _SELF is used to get the name and path of the current file - good, but it can also be used by hackers - bad. If your page has PHP _SELF, the user can enter a slash (/) and write malicious XXS scripts.

Let's consider an example:

"method =" post ">

Now, if the user came from a normal url, then the address bar will contain something like:
http://www.yourdomain.com/form-action.php
and the code above can be read like this:

In this case, as you can see, everything is fine.

Now let's look at the situation when the user starts "cheating" with the address bar:
http://www.yourdomain.com/form-action.php/%22%3E%3Cscript%3Ealert("xss")%3C
/ script% 3E% 3Cfoo% 22

In this case, after running PHP, your code will look like this:

You can see for yourself that a script tag and an alert command have been added to the code. When this page is loaded, the user will see a warning window. This is a simple example of how the PHP _SELF variable can be exploited.

Any JavaScript code can be added between script tags. A hacker can also link to a JavaScript file that will be located on another server. This file is likely to contain malicious code through which a hacker can change global variables and forward the form to another address in order to intercept user input.

How to Avoid PHP _SELF Trouble

The trouble can be avoided by using the htmlentities () function. Take a look at the code for the form where the htmlentities () function is present.

"method =" post ">

The htmlentities () function converts all possible characters to their corresponding HTML entities. Now, an attempt to bypass the PHP _SELF variable will fail and the result of malicious code injection will be expressed as follows: