News for hackers. Stuff that matters.

A comment on Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF.

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by TazeTSchnitzel on Monday July 08, 2019 @07:29PM (#20387724)
If you wonder why PHP does this, I think it comes from our old friend register_globals. In the past, query string, request body and cookie values were automatically made into global variables, so they needed to have variable-friendly names.
[ Parent | on HN ]
Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by meritt on Monday July 08, 2019 @10:18PM (#20388487)
Correct, this behavior is well-known and has been around for 20+ years. Leading spaces are removed and additionally other spaces or dots are converted to an underscore.

For this reason, many frameworks ignore the default $_GET structure and instead access the raw URI query in $_SERVER['QUERY_STRING'].

[ Parent | on HN ]