Path Disclosure and PHP

I have looked at the plain security that is in practice by most PHP developers and it is not very pretty. Like you said passing an array instead of a string forces this error.

I have always thought of type casting as something that should be done anyway, it is highly important not only to getting the right kind of data but also foring it to stay away from some unexpected types. Also to get rid of the notice error when trying to do the index it is just easier to just do the ternary operator

$name = empty() ? null : htmlspecialchars((string) $_GET['name']);

Thus keeping my expected variable set meanwhile checking to see that it exists and it is not empty or 0.

For a production environment I do not actually have error reporting on except for the E_USER_* error types. This way my custom error handler handles user errors and I log all the rest. Thus keeping the errors I trigger showing and without a file or line numbers and hiding any other type of error that may have occurred.

If you take something like this:
$name = array('foo', 'foo2', 'foo3');
$name = empty($name) ? null : htmlspecialchars((string) $name);
echo $name;

you will get the string Array. Why would this nessesarily be a bad thing, this normally this is after you have your predetermined business logic but really if they passed that it should be of the right constrant at that time anyhow.

Would you want one of the names to be used? I think that if the input is wrong in the first place we don't want it so checking types is normally a good option.

Something first of all like:
if (!empty($_GET['name']) && is_string($_GET['name'])) {
$name = htmlspecialchars((string) $_GET['name']);
}

because see if it is an array you shouldn't really be parsing it anyway... Input parameters should be very strict to be of the type that you want instead of trying to defaultly handle it if someone is fooling around with the application.

A good security measure if people are fooling around is to log it, force them to go back and if there is a continuing of 2 or 3+ tries block the requests and block there address from future usage of the site.

Now to see what I mean for the input run a sript like the following:
/** input parameters
*name[]=foo&name[]=foo2&name[]=foo3
* expected result: name not set.
*/
$name = 'name not set';
if (!empty($_GET['name']) && is_string($_GET['name'])) {
$name = htmlspecialchars((string) $_GET['name']);
}
echo $name;

this is where type casting really helps and makes things much nicer... better to be extremely paranoid than to let a varable seep in. Now really you wouldn't need to type cast there telling it to cast it to a string because the is_string already checks for that constraint... why do I do it anyway? If there ends up being a bug in php that allows a constraint to change in the way it handles there is always a backup. Pretty much known as double handling and expecting problems to be where there may never be problems.

Mike