PHP :: Bug #60180 :: $_SERVER["PHP_SELF"] incorrect

Bug #60180 $_SERVER["PHP_SELF"] incorrect
Submitted: 2011-10-31 17:25 UTC Modified: 2011-11-01 15:32 UTC
From: david dot gero at ec dot gc dot ca Assigned: laruence (profile)
Status: Closed Package: Built-in web server
PHP Version: 5.4SVN-2011-10-31 (snap) OS: Windows XP with SP3
Private report: No CVE-ID: None

 [2011-10-31 17:25 UTC] david dot gero at ec dot gc dot ca

Description:
------------
When going to, for example, /admin/phpinfo.php/foo/bar?foo=bar, you should get the following (using Apache and PHP on Windows XP):

$_SERVER["REQUEST_URI"]  == "/admin/phpinfo.php/foo/bar?foo=bar"
$_SERVER["PHP_SELF"]     == "/admin/phpinfo.php/foo/bar"
$_SERVER["SCRIPT_NAME"]  == "/admin/phpinfo.php"
$_SERVER["PATH_INFO"]    == "/foo/bar"
$_SERVER["QUERY_STRING"] == "foo=bar"

In the snap for October 31, 2011, REQUEST_URI, PATH_INFO and QUERY_STRING are correct, but the following are wrong:

$_SERVER["PHP_SELF"] == "\admin\phpinfo.php" (slashes incorrectly replaced by backslashes, and PATH_INFO ending has been incorrectly removed)
$_SERVER["SCRIPT_NAME"] == (missing completely)

Test script:
---------------
phpinfo.php file contains:

<?php phpinfo(); ?>

Expected result:
----------------
Going to /admin/phpinfo.php/foo/bar?foo=bar should get:

$_SERVER["REQUEST_URI"]  == "/admin/phpinfo.php/foo/bar?foo=bar"
$_SERVER["PHP_SELF"]     == "/admin/phpinfo.php/foo/bar"
$_SERVER["SCRIPT_NAME"]  == "/admin/phpinfo.php"
$_SERVER["PATH_INFO"]    == "/foo/bar"
$_SERVER["QUERY_STRING"] == "foo=bar"


Actual result:
--------------
$_SERVER["REQUEST_URI"]  == "/admin/phpinfo.php/foo/bar?foo=bar" (correct)
$_SERVER["PHP_SELF"]     == "\admin\phpinfo.php" (incorrect)
$_SERVER["SCRIPT_NAME"]  == (not set)
$_SERVER["PATH_INFO"]    == "/foo/bar" (correct)
$_SERVER["QUERY_STRING"] == "foo=bar" (correct)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

 [2011-10-31 17:40 UTC] david dot gero at ec dot gc dot ca

Should have said that the snap was tested with the built-in PHP web server, and I was comparing it against the standard Apache + PHP setup