使用$_REQUEST作为数据是错误的吗？
所以，我已经编码了一点（2年）了，我有一个非常主观的问题：
使用 $_REQUEST 来获取数据是错误的吗？
顺便说一句，这主要与身份验证有关。
如果您考虑一下数据在 $_REQUEST 中出现的 3 种方式，它可以来自 cookie、表单或查询字符串。现在，我知道大多数人直接从 $_POST 或 $_GET 获取信息，仅在需要 cookie 时才使用 $_COOKIE 。
我的理论是，实际上，这些数据不应该有任何差异，并且如果您将 $_POST 或 $_GET 替换为 <代码>$_REQUEST。
如果您要对系统中的用户进行身份验证，那么身份验证详细信息是否包含在 $_POST 或 $_GET 数组中真的很重要吗？哎呀，它们是否在 $_COOKIE 中可能也不重要。他们仍然为您提供登录该网站的凭据，您应该检查其正确性，如果是的话，请登录。
现在，我确实意识到，如果您尝试使用通过查询字符串提交数据的登录表单，则会存在安全问题，但我不认为这与这个问题有关。此外，如果某人登录失败次数过多，则应设置适当的限制以避免服务器过载。
我想在这里发表一下对此的看法。
社区维基百科是很好的衡量标准。
哦，顺便说一句，如果您对 $_REQUEST
为什么我应该使用 $_GET 和 $_POST 而不是 $_REQUEST？ 何时以及为何应使用 $_REQUEST而不是 $_GET / $_POST / $_COOKIE？
So, I've been coding for a little (2 years), and I have a very subjective question:
Is it wrong to use $_REQUEST for Data?
This mainly pertains to authentication by the way.
If you think about the 3 ways data can occur in $_REQUEST, it can come from either a cookie, a form, or a query string. Now, I know that most people directly grab the information from either $_POST or $_GET, using $_COOKIE only when they are expecting a cookie.
My theory is that in reality, there shouldn't be any difference in this data, and it shouldn't make any difference if you replaced $_POST or $_GET with $_REQUEST.
If you are authenticating a user into the system, does it really mattered if the authentication details are contained in the $_POST or $_GET array? Heck, it probably shouldn't matter if they are in $_COOKIE either. They are still giving you credentials to log into the site, which you should check for correctness, and if so log them in.
Now, I do realize there are security issues if you try to have a login form that submits data via a query string, but I don't believe that pertains to the question. Also, if someone fails a login too many times, there should be proper limits set in place to avoid overloading the server.
I'd like to here the opinion about this.
Community Wiki'd for good measure.
Oh, and just by the way, here are other StackOverflow questions that relate if you have other questions about $_REQUEST
Why should I use $_GET and $_POST instead of $_REQUEST?
When and why should $_REQUEST be used instead of $_GET / $_POST / $_COOKIE?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
在“良好”的编码实践中，您希望尽可能地消除歧义。
由于默认情况下 $_REQUEST 包含来自 $_POST、$_GET 和 $_COOKIE 的数据，因此存储使用 $_REQUEST 检索到的数据的变量所保存的值对于其来自哪个方法将是不明确的。
如果说得更具体一些，有利于代码的可读性，也有利于逻辑的理解，也有助于以后的调试。
（更不用说每种方法的安全问题了，尤其是 $_GET 方法）
In "good" coding practice, you want to disambiguate as much as possible.
Since $_REQUEST contains the data from $_POST, $_GET, and $_COOKIE by default, the value held by the variable that stores the data retrieved using $_REQUEST will be ambiguous as to which method it came from.
If we are more specific, it will benefit readability of code, as well as understanding of logic, and helps for debugging in the future.
(Let alone the security issues concerning each method, especially the $_GET one)
我想说的是一起避免这一切。我同意 Sev 的观点，即消歧很重要，原因有很多（调试、清晰/自文档、优雅等），但可能会出现重大的安全问题，这将是我避免它的主要原因。
举一个简单的例子，当在两个数组中发送相同的密钥时会发生什么（例如
$_POST['riticInfo']和$_GET['riticInfo']） ？与大多数安全问题一样，这些漏洞会在单独的实施中出现，因此不可能猜测您的具体风险。事实上，模糊性常常会带来漏洞。I'd say avoid it all together. I agree with Sev that disambiguation is important for many reasons (debugging, clarity/self-documentation, elegance, etc.), but there are significant security issues that could arise, and that would be my main reason for avoiding it.
As a simple example, what happens when the same key is sent in two of the arrays (e.g.
$_POST['criticalInfo']and$_GET['criticalInfo'])? As with most security issues, the vulnerabilities present themselves in the individual implementation, so it would be impossible to guess your specific risks. The fact is that ambiguity often opens up holes.不要将其留给 PHP_INI 中的“variables_order”来确定脚本从何处获取变量。使用 $_GET、$_POST 等。
Don't leave it up to "variables_order" in PHP_INI to determine where your script gets variables from. Use $_GET, $_POST, etc.
它还涉及不允许凭据以 POST 请求以外的任何其他方式出现。我不希望我的 GET 请求产生副作用（例如登录用户）。
It is also about not letting credentials come in any other way than a POST request. I would not want my GET request to have side-effects (like logging in the user).
这是错误吗？不是。
它比
$_GET或$_POST差吗？是的。使用正确的数组，您将避免由于不知道$_REQUEST的数组内容来自何处而产生的各种问题。Is it wrong? No.
Is it inferior to
$_GETor$_POST? Yes. Use the right array and you'll avoid all kinds of problems that stem from not knowing where the array contents of$_REQUESTcame from.