Question

Consider the following snippets of code:

Exhibit A:

$_REQUEST = json_decode(stripslashes(json_encode($_REQUEST, JSON_HEX_APOS)), true);

Exhibit B:

${'_REQUEST'} = json_decode(stripslashes(json_encode(${'_REQUEST'}, JSON_HEX_APOS)), true);

Exhibit C:

${'_' . 'REQUEST'} = json_decode(stripslashes(json_encode(${'_' . 'REQUEST'}, JSON_HEX_APOS)), true);

---

Both exhibit A and B work perfectly fine, exhibit C however displays a very strange error message:

Notice: Undefined variable: _REQUEST

What makes it even more weird is that this only happens with the $_REQUEST superglobal, if I try it with $_GET, $_POST or $_COOKIE all experiments work fine without raising error notices.

I’m guessing this is a PHP bug? I’m running on PHP 5.3.0.

Answer 1

(I tested with PHP 5.3.1)

One funny thing is that this portion of code :

<?php
var_dump(${'_' . 'REQUEST'});

Gets the notice Undefined variable: _REQUEST

But this one :

<?php
var_dump($_REQUEST);
var_dump(${'_' . 'REQUEST'});

Doesn’t give any notice, and shows two empty arrays.

For a while, I though this could be related to auto_globals_jit, but $_REQUEST doesn’t seem to the concerned by that directive… But there is one interested thing said, here :

Usage of SERVER and ENV variables is
checked during the compile time so
using them through e.g. variable
variables will not cause their
initialization.

Maybe, after all, even if it’s not said in the manual, auto_globals_jit has an impact on $_REQUEST…

And, to be sure, I turned Off auto_globals_jit in my php.ini file :

; When enabled, the SERVER and ENV variables are created when they're first
; used (Just In Time) instead of when the script starts. If these variables
; are not used within a script, having this directive on will result in a
; performance gain. The PHP directives register_globals, register_long_arrays,
; and register_argc_argv must be disabled for this directive to have any affect.
; http://www.php.net/manual/en/ini.core.php#ini.auto-globals-jit
auto_globals_jit = Off

And tried this code again :

<?php

var_dump(${'_' . 'REQUEST'});

And I now get an empty array, and not a notice anymore.

So it seems auto_globals_jit does indeed have an impact on $_REQUEST — even if it’s not mentionned in the manual.