0 Members and 1 Guest are viewing this topic.
global $scripturl;echo '<form id="chgtheme" action="'. $scripturl .'" method="post"></form><script type="text/javascript"><!-- // --><![CDATA[ document.getElementById("chgtheme").action = "'. $scripturl .'?theme=1"; document.getElementById("chgtheme").submit();// ]]></script>';
Dots in incoming variable namesTypically, PHP does not alter the names of variables when they are passed into a script. However, it should be noted that the dot (period, full stop) is not a valid character in a PHP variable name. For the reason, look at it:<?php$varname.ext; /* invalid variable name */?>Now, what the parser sees is a variable named $varname, followed by the string concatenation operator, followed by the barestring (i.e. unquoted string which doesn't match any known key or reserved words) 'ext'. Obviously, this doesn't have the intended result.For this reason, it is important to note that PHP will automatically replace any dots in incoming variable names with underscores.
1. Code doesn't work for me at all, just does nothing. In any case I'm not entirely sure what that's trying to prove. I note that at no point was this mentioned in the original report.
//> add by PortaMx elseif($url_array[0] == 'language' || $url_array[0] == 'theme') { $querystring[$url_array[0]] = $url_array[1]; array_shift($url_array); array_shift($url_array); }//>
parse_str(!empty($url_parts['query']) ? $url_parts['query'] : '', $params);
//> modify by PortaMx if(!empty($url_parts['query'])) { if(strpos($url_parts['query'], '=') !== false) parse_str($url_parts['query'], $params); else $params[$url_parts['query']] = ''; }//>