17

I am developing a backend with php here.

I am having problem with such error like this:

Undefined variable : PHP_SELF

on my htdocs directory.

I'm developing with php 5.4.4 , and if you want to look at the source code here it is:

http://pastebin.com/xr2PxbNG

9
  • 5
    Were you actually looking for $_SERVER['PHP_SELF'] ?
    – Jonnix
    Oct 3, 2012 at 14:39
  • I am building them in my localhost. Let me change them for a moment :)
    – adadeh
    Oct 3, 2012 at 14:43
  • 4
    @FirmView I would not suggest that.
    – Peon
    Oct 3, 2012 at 14:45
  • @FirmView: Nah, we don't do that anymore. While the associated problems mainly arise from running all other code in global scope as well, it's best for newcomers to eschew that feature.
    – mario
    Oct 3, 2012 at 14:45
  • 1
    And here goes register_global_variables :)
    – Vyktor
    Oct 3, 2012 at 14:48

8 Answers 8

22

Do not use any of the suggested versions of PHP_SELF. It is a security nightmare, opening up your PHP to a multitude of possible injection attacks.

What are you trying to achieve? Generate the URL for a form sending to itself? Use action="" for that - it is a valid approach and will always use the URL for sending the form as for loading.

If you must know the requested script, use $_SERVER['SCRIPT_NAME'] instead.

1
  • I think it is better to play with the settings when learning in localhost and explore
    – FirmView
    Oct 3, 2012 at 14:51
14

You are using $PHP_SELF it should be

echo $_SERVER['PHP_SELF'] ;

Or

$PHP_SELF = &$_SERVER['PHP_SELF'];
echo $PHP_SELF ;

You can also have

define("PHP_SELF",$_SERVER['PHP_SELF']); 
echo PHP_SELF ;
4
  • +1 @FirmView this one is for you var_dump($_SERVER['PHP_SELF'] == $_SERVER['REQUEST_URI']) // true
    – Baba
    Oct 3, 2012 at 14:49
  • 2
    It is OK More references is better :)
    – adadeh
    Oct 3, 2012 at 14:55
  • For sanitizing the variable contents & making it more resilient to injection attacks I found this somewhere: $PHP_SELF = htmlentities($_SERVER['PHP_SELF']);. Using this in production has worked OK. Apr 30, 2015 at 17:56
  • @DavidRamirez Your way is wrong, and your reasoning "it has worked ok" is flawed. In general PHP_SELF doesn't contain any characters that would be changed by htmlentities(), so it is natural that it works with positive cases. But you must want to have perfect protection against ANY attack - only making it "more resilient to injection attacks" simply isn't enough, these type of attack must be made completely impossible! And it is possible to do so, but it requires knowledge about how to correctly escape data - your solution isn't such.
    – Sven
    May 19, 2015 at 20:00
3

Are you trying to access $_SERVER['PHP_SELF'] ?

0
1

Looks like certain WordPress distributions declare $PHP_SELF = $_SERVER['PHP_SELF'] for reasons I can't say, must be some sorta legacy thing.

1

I have to Solve This Error Using Page Url... Ex. Like

echo "<a href=\"$_PHP_SELF?page=$last\">Last 3 Records</a>";

You Have to remove $_PHP_SELF and use page URL insert.php .......

1

I was getting the same, Notice: Undefined variable _PHP_SELF So I just replaced $_PHP_SELF to $_SERVER[PHP_SELF] Now I don't get any extra no

0

Some shells will erase the value of $_SERVER['PHP_SELF'] as a security measure. You may need to look at $_SERVER['argv'][0] if this is what is happening to you.

-1

I solved starting the variable:

$PHP_SELF = NULL;
$Path1 = realpath(substr($PHP_SELF, 1));
$dbName = "$Path1\\BD.accdb";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.