PEAR is discontinued

This is a static archive preserving historical releases and metadata. No new packages or updates will be published. For updates to existing packages, or to publish new packages, please use Composer and Packagist.

Home » HTML » HTML_QuickForm » Bug #4098

buggy use of $_SERVER['PHP_SELF'] for default action

Details

Submitted2005-04-07 17:00 UTC
Frommichael at emaxware dot com
StatusWont fix
PackageHTML_QuickForm
PHP Version4.3.6
OSFreeBSD
Roadmaps(Not assigned)

Comments

[2005-04-07 17:00 UTC] michael at emaxware dot com

Description:
------------
using $_SERVER["SCRIPT_URL"] seems to work better.

This is at line 253 in QuickForm.php.

Reproduce code:
---------------
diff -U3 -r1.1 QuickForm.php
--- pear/PEAR/HTML/QuickForm.php 7 Apr 2005 14:42:48 -0000 1.1
+++ pear/PEAR/HTML/QuickForm.php 7 Apr 2005 16:55:01 -0000
@@ -250,7 +250,7 @@
{
HTML_Common::HTML_Common($attributes);
$method = (strtoupper($method) == 'GET') ? 'get' : 'post';
- $action = ($action == '') ? $_SERVER['PHP_SELF'] : $action;
+ $action = ($action == '') ? $_SERVER["SCRIPT_URL"] : $action;
$target = (empty($target) || $target == '_self') ? array() : array('target' => $target);
$attributes = array('action'=>$action, 'method'=>$method, 'name'=>$formName, 'id'=>$formName) + $target;
$this->updateAttributes($attributes);

[2005-04-08 05:13 UTC] michael at emaxware dot com

Granted, this condition probably is not too common, but
I'm sure its not unheard of. I'm dealing with installing
pear on a server to which I only have ftp access and
moderate apache tweaking. I have a subdomain
http://xxx.domain.com/myapp.php which is mapped to an
actual url of http://domain.com/xxx/myapp.php. When using
the first URL, PHP_SELF = /xxx/myapp.php, while SCRIPT_URL
= /myapp.php. When constructing the default action URL
for the form, /myapp.php, using PHP_SELF obviously does
not work, while SCRIPT_URL does. Its not clear to me
under what conditions SCRIPT_URL is not available. At the
very least, I would think it should be used first, if
available, then fall back to PHP_SELF.

[2005-04-08 05:22 UTC] michael at emaxware dot com

As I see it, PHP_SELF reflects the underlying PHP file
system structure, while SCRIPT_URL reflects the script's
domain context. Often those two are in sync, but when
they aren't, as in this case, SCRIPT_URL seems more
accurate when constructing a URL. I would imagine any
configuration that uses some kind of virtual hosting could
run into this kind of problem.