[2011-04-07] $_REQUEST['url'] vs $_GET['url'] about silverstripe-framework

[silverstripe-issues]

comment by: @chillu (ischommer)
created at: 2011-04-07

---

We'd have to be very careful with REQUEST_URI across server and fastCGI implementations, e.g. IIS7 seems to make problems: http://support.microsoft.com/kb/954946

Sean, what do you think?

[silverstripe-issues]

comment by: paradigmincarnate
created at: 2011-04-07

---

I looked at that microsoft bug you mentioned. The problem is IIS 7 only returns the path, not the query.

If REQUEST_URI is used, the query would have to be removed anyway, as SilverStripe expects the url to only be the path component.

The following would work across apache, IIS 6, IIS 7

$url = array_shift(explode('?', $_SERVER['REQUEST_URI']));

Regarding other http servers, sapphire/main.php already contains server-specific "fixes", so I don't see that as a hurdle. I guess the difference is we'd be fixing things to work correctly, instead of normalizing them to an incorrect.

If you're considering moving away from using $_GET['url'], the following argument may help sway you.

An example situation of where putting the url into the query will fail:

http://www.example.com/segment%2Fone/segment-two?param=value

An .htaccess will rewrite this to:

http://www.example.com/sapphire/main.php?url=segment%2fone/segment-two&param=value

PHP will further decode this into the $_GET superglobal.

print_r($_GET);
// Array
// (
//   [url] => segment/one/segment-two
//   [param] => value
// )

As you can see, it thinks there are 3 segments in the path: "segment", "one", and "segment-two".

In fact we had only 2 segments: "segment%2Fone", and "segment-two".

If necessary I can provide other examples cases, such as using "&" or "+" in the path (which is otherwise legal).

[silverstripe-issues]

comment by: @chillu (ischommer)
created at: 2011-04-07

---

I don't think we'll be able to completely do away with $_GET['url'], as we're technically supporting routing without rewriting: index.php?url=home/ - but that might just mean setting the REQUEST_URI manually in index.php, and removing $_GET['url'] from main.php/cli-script.php

[sminnee]

This will be rendered obsolete by more fundamental bootstrap fixes planned for SS4.

[tractorcow]

Surely the easiest way to fix this is to replace all use of $_REQUEST['url'] with $_GET['url'] or SS_HTTPRequest::getUrl()

I might do this in a separate pull request anyway, along with other direct access to $_SERVER variable.