Security vulnerabilities of using input-generated variables in PHP - php

Question

Given knowledge of the following problematic PHP code, where variables are generated based on the request data (e.g. submitted HTML form fields), what exploits are possible?
I'm aware that the request could be constructed to contain data specifically crafted to overwrite existing variables (although we're blind to what variables exist), and thereby break the application, I'm just struggling to think of ways it could break the application for gain.
<?php
function foo( $data ) {
// Some unknown code may exist here
foreach( $data as $key => $value) {
$$key = $value;
}
// Some other unknown code may exist here
}
if ( ! empty($_POST) ) {
foo( $_POST );
}

Answer 1

<?php
$userid = $_SESSION['uid'];
function foo( $data ) {
// Some unknown code may exist here
//$_POST contains userid field;
foreach( $data as $key => $value) {
$$key = $value;
}
// Some other unknown code may exist here
}
if ( ! empty($_POST) ) {
foo( $_POST );
}
$credit_card_no = $cardDetails->getById($userid);
echo 'your current card on file is: ' . $credit_card_no;

Answer 2

Variables are placeholders in your algorithm, they represent values which get filled in at runtime. In your algorithm you do certain things with these values, and you depend on those values to be in a certain known state to some degree or another. Usually the variables, the placeholders, in your algorithms are fixed and are operated on in a certain order; that is the definition of your algorithm.
we take A
and assign to it B
and then we assign A to C
and then we pass C to the function X
...
Variable variables now are basically allowing you to modify those operations based on other values:
we take A
and assign to it B
AND THEN WE ASSIGN B TO ??? <---
and then we assign A to C
and then we pass C to the function X
...
Well, what variable was B assigned to? How is the rest of your algorithm going to behave from now on? Can you trust your knowledge about the state of any particular variable anymore now?
Those are the problems that variable variables based on user input create. It's not impossible to code carefully enough to avoid this being a problem, but you do have to be extremely careful.

Answer 3

Never trust user generated data. It's very dangerous code because you can easily overwrite the superglobals for example.
Read more about the risks:
http://www.php.net/manual/en/security.globals.php
http://php.net/manual/en/function.extract.php
Better use a whitelist with the keys that you expect:
// no whitelist
$_POST = array('foo' => 'bar', '_GET' => array('foo' => 'bar'), '_SESSION' => array('foo' => 'bar'));
foreach ($_POST as $key => $value) {
$$key = $value;
}
echo $foo;
print_r($_GET);
print_r($_SESSION);
// whitelist
$whitelist = array('foo');
$_POST = array('foo' => 'bar', '_GET' => array('foo' => 'bar'), '_SESSION' => array('foo' => 'bar'));
foreach ($_POST as $key => $value) {
if (in_array($key, $whitelist)) {
$$key = $value;
}
}
echo $foo;
print_r($_GET);
print_r($_SESSION);