[Full-disclosure] PHP Array and Null Bytes



Hi guys,

some questions to NULL Bytes within PHP Arrays.

Let us assume there exist a php script with the following code.

$erg=$_GET['show']

if(!isset($arr[$erg]) $erg="something";

$arr is a predefined variable but with "register globals on" it would be
possible to set your own Array Key. This means when you set

$erg=test
$arr[test]

you could deliver almost every chars you want. My problem is that
i want to deliver a content like that.

$erg=index.html%00
$arr[index.html%00]

The problem is that the Null Byte within the array destroy the array.
My question is if there exist a way to avoid the Null Byte within
the array. For example (im not really familiar with charsets)
to create the Null Byte with the help of f.e. UTF-7 encoded
chars.

If someone has an idea please let me know.

Best regards

Steve

begin:vcard
fn:Steve
n:Lochbihler;Stefan
email;internet:steve01@xxxxxxxxx
x-mozilla-html:FALSE
url:http://www.xion-security.at
version:2.1
end:vcard

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: [PHP] Re: Design Dilemma - Database Data Abstraction
    ... > application) done in PHP5 following the MVC design pattern. ... > a) tables with only one field in the PK (usually an autonumeric int). ... > My dilemma is as follows: a PHP array is a construct more restricted ... > rather stick to keeping this as seemingly equal to PHP arrays. ...
    (php.general)
  • Re: Design Dilemma - Database Data Abstraction
    ... were PHP arrays, meaning that a table is presented as an array of records. ... tables with only one field in the PK (usually an autonumeric int). ... But this indexation has its pros. ...
    (php.general)
  • Design Dilemma - Database Data Abstraction
    ... I have a dilemma on a design where I humbly ask your help. ... were PHP arrays, meaning that a table is presented as an array of records. ... tables with only one field in the PK (usually an autonumeric int). ...
    (php.general)
  • Re: [PHP] Design Dilemma - Database Data Abstraction
    ... >were PHP arrays, meaning that a table is presented as an array of ... then update or recreate the database tables from ... Basically all "array" operations will be traslated to the corresponding DB ... primary key as the array key and leave it at that. ...
    (php.general)
  • Re: [PHP] Design Dilemma - Database Data Abstraction
    ... a database in the first place, but okay, I guess... ... look and act like PHP arrays, why don't just use that API for something like ... In a PHP array the index is either an int or a string, ...
    (php.general)