Assign multiple values to array via parse_str

Question

I know that you can add values to an array via parse_str() like so:

parse_str( 'a[]=1&a[]=2&a[]=3' );
parse_str( 'a[0]=1&a[1]=2&a[2]=3' );

These both produce:

Array (
  [0] => 1
  [1] => 2
  [2] => 3
)

I'm looking to produce an array sort of like this:

parse_str( 'a[]=1,2,3' );

Is there any way of doing this, so that I don't need to type a[i]= every single time?

I would not use parse_str(), is a potential security hole. — Darien
– Darien, Commented Sep 11, 2013 at 2:49
Unreliable input can cause bugs, and untrusted input can overwrite even superglobals, e.g.: parse_str('_SERVER[DOCUMENT_ROOT]=/tmp') which would be a pretty bad thing if later on you want to refer to $_SERVER['DOCUMENT_ROOT'] for some other purpose like checking folder security. — Darien
– Darien, Commented Sep 11, 2013 at 2:59
What exactly is the use-case here? Where would 'a[]=1,2,3' come from? — Ja͢ck
– Ja͢ck, Commented Sep 11, 2013 at 3:22
The fact that you expressed concern about typing suggests that you are creating this manually. If that's the case, why are you not using $a=array(1,2,3); or $a=array('1','2','3'); — TecBrat
– TecBrat, Commented Sep 11, 2013 at 10:07
Yes, I am creating this manually. I'm parsing lines from a text file in order to list conjugations of Spanish verbs in the most efficient way possible. — Marcus McLean
– Marcus McLean, Commented Sep 11, 2013 at 13:29

Darien · Accepted Answer · 2013-09-11 03:04:43Z

2

Don't use parse_str(), not unless you're very sure about what you're doing. (Explained below.) Instead, I would suggest something like JSON, which doesn't change unexpected variables, is fairly fast, standardized, and easier to generate/consume.

$str = '{"items":[1,2,3]}'
$obj = json_decode($data);

var_export($obj->items);

Yields:

 array (
  0 => 1,
  1 => 2,
  2 => 3,
)

"Why not parse_str?"

Bad input can easily break your code by overwriting variables you don't expect
Malicious input can introduce security risks.

For example, try this:

$input = '_SERVER[DOCUMENT_ROOT]=/foo';
parse_str($input);
echo($_SERVER['DOCUMENT_ROOT']);

Wow, someone managed to change one of the variables that was storing server-configuration data. This could easily break stuff like content-management code that will then save files to the wrong place, or to bypass "must be a subfolder of" checks.

edited Sep 11, 2013 at 3:04

answered Sep 11, 2013 at 2:55

Darien

3,6021 gold badge22 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Ja͢ck Over a year ago

Don't use parse_str() without the second argument would be better advice :)

Darien Over a year ago

Fair enough, but I'd still argue it's ancient and syntactically barbaric :p JSON also offers Marcus the terse 1,2,3 style he's asking for.

Ja͢ck Over a year ago

It's very useful in situations where you need to decode a given url.

Darien Over a year ago

@Jack The query portion, I suppose, but the other 99% of the time the stuff you want is already in $_GET.

Ja͢ck Over a year ago

As with anything, you need to know when to use something.

Collectives™ on Stack Overflow

Assign multiple values to array via parse_str

1 Answer 1

"Why not parse_str?"

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

"Why not parse_str?"

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related