diff options
author | Andrey Andreev <narf@devilix.net> | 2016-12-14 12:45:45 +0100 |
---|---|---|
committer | Andrey Andreev <narf@devilix.net> | 2016-12-14 12:45:45 +0100 |
commit | ff773c059cb984920767dd6187c30a77e5bf78c9 (patch) | |
tree | d5a33583d47199423451c72e5e3ec206fb8f0e02 /user_guide_src/source/installation/upgrade_320.rst | |
parent | 4e0c208f24b0755c47905e17b82854c538a0c530 (diff) |
Finally drop CI_Input::_sanitize_globals()
Close #4101
Diffstat (limited to 'user_guide_src/source/installation/upgrade_320.rst')
-rw-r--r-- | user_guide_src/source/installation/upgrade_320.rst | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/user_guide_src/source/installation/upgrade_320.rst b/user_guide_src/source/installation/upgrade_320.rst index 6501f40db..8434172e7 100644 --- a/user_guide_src/source/installation/upgrade_320.rst +++ b/user_guide_src/source/installation/upgrade_320.rst @@ -159,3 +159,21 @@ CodeIgniter versions that have been removed in 3.2.0: - ``send_email()`` (use ``mail()`` instead) - The entire *Smiley Helper* (an archived version is available on GitHub: `bcit-ci/ci3-smiley-helper <https://github.com/bcit-ci/ci3-smiley-helper>`_) + +Step 8: Make sure you're validating all user inputs +=================================================== + +The :doc:`Input Library <../libraries/input>` used to (often +unconditionally) filter and/or sanitize user input in the ``$_GET``, +``$_POST`` and ``$_COOKIE`` superglobals. + +This was a legacy feature from older times, when things like +`register_globals <https://secure.php.net/register_globals>`_ and +`magic_quotes_gpc <https://secure.php.net/magic_quotes_gpc>`_ existed in +PHP. +It was a necessity back then, but this is no longer the case and reliance +on global filters is a bad practice, giving you a false sense of security. + +This functionality is now removed, and so if you've relied on it for +whatever reasons, you should double-check that you are properly validating +all user inputs in your application (as you always should do). |