How does the file receive the $_POST?

Question

Good morning guys, I have to do a maintenance on an old form and I’m trying to understand how it works...

Below the form_proposta.php file

<?
$msg = "Mais informações de imóvel enviado em " . date("d/m/Y") . ", os dados seguem abaixo: " . chr(13) . chr(10) . chr(10); //nessa linha, estará impresso em que data e hora foi enviado o formulário
$msg .= "Código : " .$codigo . chr(13) . chr(10);
$msg .= "Nome : " . $nome . chr(13) . chr(10); //aqui o campo nome 
$msg .= "E-mail  : " . $email . chr(13) . chr(10); //campo email
$msg .= "Endereço : " . $endereco . chr(13) . chr(10); //campo endereco
$msg .= "Telefone : " . $telefone . chr(13) . chr(10); //campo telefone
$msg .= "Mensagem : " . $mensagem . chr(13) . chr(10); //campo mensagem

$Remetente = $email; //aqui, colocamos que o email digitado seja quem enviou o formulário, pode ser substituido por "Contato do Site", assim, sairá sempre que quem  enviou o email, seja Contato do Site

$para = $email_from;

mail($para, "Proposta do site",$msg,"From: $Remetente\n");
?>

Below follows the html of the page

<form action="../exec/form_proposta.php" method="post" >
                    <table align="center" border="0" cellpadding="0" cellspacing="1" >
                        <tr align="left">
                            <td align="left">C&oacute;digo:&nbsp;&nbsp; </td>
                            <td align="left">
                                <h1>{$imo_cod}</h1>
                            </td>
                        </tr>
                        <tr align="left">
                            <td >Nome:&nbsp;&nbsp;</td>
                            <td align="left"> <input type="text" name="nome" style="width:400px;" class="campo"> </td>
                        </tr>

                        <tr align="left">
                            <td>E-mail:&nbsp;&nbsp;</td>
                            <td align="left"> <input type="text" name="email" style="width:400px;" class="campo">  </td>
                        </tr>

                        <tr align="left">
                            <td>Telefone:&nbsp;&nbsp;</td>
                            <td align="left"> <input type="text" name="telefone" style="width:400px;" class="campo"> </td>
                        </tr>

                        <tr align="left">
                            <td>Endere&ccedil;o:&nbsp;&nbsp;</td>
                            <td align="left"> <input type="text" name="endereco" style="width:400px;" class="campo"> </td>
                        </tr>


                        <tr align="left">
                            <td align="left">Mensagem:&nbsp;&nbsp; </td>
                            <td align="left"> <textarea rows="6" name="mensagem" style="width:400px;" class="campo"></textarea> </td>
                        </tr>
                        <tr>
                          <td colspan="2" align="center"><br>
                            <input type="submit" name="submit" value="Enviar" style="width:100px;" class="campo" /> &nbsp;&nbsp;&nbsp;                  
                            <input type="reset" name="reset" value="Limpar" style="width:100px;" class="campo" />   
                            <input type="hidden" name="codigo" value="{$imo_cod}" />
                            <input type="hidden" name="email_from" value="{$alt_email}" />  
                          </td>
                        </tr>
                    </table>
                </form>

I’ve been looking at these codes for a long time and do not understand how this business can work, the php file is not included in nor is another file triggered directly by the form...

At no time did I find the location where $_POST is taken and $variables are assigned...

Basically my conclusion so far is that it works with magic kkk Could someone help me understand how this business works?

Answer 1

When the Register Globals is enabled the querystrings passed in a variable url will come or it is a wide open port for attackers to inject malicious code. Na in php5.3 this feature was discontinued and php5.4 removed.

To solve the problem you will need to manually assign the variables the value of $_POST/$_GET and gradually migrate this because this feature is evil level 9999³³³³³³³.

with Register globals on

$msg = "Código : " .$codigo . chr(13) . chr(10);

As it should be

$msg = "Código : " . $_POST['codigo'] . chr(13) . chr(10);

Answer 2

Another thing that can be done not to need to move a lot is to use the extract().

Since you have a form with the names of the correctly defined fields, you could use extract($_POST), solving the problem;