Page MenuHomePhabricator

Merging $_GET and $_POST with array_merge is a bad idea
Closed, ResolvedPublic


Author: lrbabe

Recently, the way we deal with REQUEST datas has changed (see
We doesn't use any more $_REQUEST, instead we merge $_GET and $_POST with array_merge($_GET, $_POST) and $_POST overrides $_GET datas wich share same keys (see
But the array_merge function has a side effect : pure numeric (not beginning with 0) keys of $_GET and $_POST are changed (see!
Despite the fact that numeric names are forbidden in HTML (see, people using them in extension (for example) will get confused. Moreover, it breaks some backward compatibility, for example with the quiz extension (see and test that :

Solutions are :

  • changing $this->data = array_merge($_GET, $_POST); simply with $this->data = $_GET + $_POST; wich should works as expected and does'nt seems to have any contraindication (once again, see
  • checking both $_POST and $_GET for pure numeric keys and throwing an exception.

PS : I apologize for my poor english level.

Version: 1.12.x
Severity: normal
OS: Linux
Platform: PC



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:07 PM
bzimport set Reference to bz13139.
bzimport added a subscriber: Unknown Object (MLST).

ayg wrote:

CC'ing Brion, who committed r30882.

Fixed in r31327. Replaced array_merge() with wfArrayMerge() which behaves in a sane fashion.

Gee, I wish we didn't have to reimplement half of PHP's standard library.