Declaring variables

[csdude55]

I'm suddenly seeing a bajillion warnings in my PHP error log for undefined variables, most often when they're used like:

if ($_GET['foo']) $bar = 'whatever';

which gives a warning of "Undefined index: foo".

Is this a new thing in PHP 7.x, a constant thing that I just never noticed, or is there a PHP setting I can change to make it stop? It looks like I have about 100 unique pages in my error log that are throwing these warnings; I spent all day working on it and fixed 4 of them >:-(

[phranque]

you can either check if the index is defined before using it (isset [php.net])
or you can change which errors are reported (error_reporting [php.net])

[csdude55]

I've been going through everything and either adding isset() everywhere or adding a series of $foo = false at the top of the script, which is just a hugely time consuming pain :-(

In your opinion, @phranque, is declaring them and/or using isset() a valuable use of my time, or should I just remove E_NOTICE from the reporting and be done with it?

[phranque]

i would look for better methods to search and replace code and then fix it everywhere.

[csdude55]

Easier said than done, I'm afraid :-( All of my code is hand-rolled, so I can't think of any automated way of doing it.

[phranque]

i typically use command line tools like grep and sed for things like this.
every once in a while i have to refamiliarize myself with awk for such tasks.

[dstiles]

For get and post I implement functions which apply isset and also gets rid of unwanted or dangerous character from the input. The principle funtion, FormVar, is for form POST, with a secondary one for GET if the POST version returns empty. The principle one can also return a default value if the form field is empty. Once set up I (almost) never need to worry about it again.

function FormVar($ifld,$dflt) {
$tmp=""; $fld=$ifld;
if (isset($_REQUEST[$fld])) { $tmp=$_REQUEST[$fld]; }
if (empty($tmp)) { $tmp=$dflt; }
$tmp=htmlspecialchars($tmp);
$tmp=trim($tmp);
return($tmp);
}

function FormVarG($fld) {
$tmp=FormVar($fld,"");
if (empty($tmp)) {
 $tmp=(isset($_GET[$fld]) ? $_GET[$fld] : "");
 $tmp=htmlspecialchars($tmp);
 $tmp=trim($tmp);
 }
return($tmp);
}

For actually reading form fields I have an extra function to disallow characters on a field by field basis using preg_match, calling FormVar for each field and then checking against the permitted characters list or php functions such as filter_var.

[w3dk]

Is this a new thing in PHP 7.x

No, this has been part of PHP since "forever". Not sure why you are suddenly seeing these message since the default error_reporting has not changed in this regard AFAIK.

You should always develop with E_NOTICE messages enabled, even if you disable this in production. (Although it would be recommended to leave it enabled).

E_NOTICE messages such as this give you an immediate clue as to potential runtime errors. eg. If you mistype a variable name you'll get an E_NOTICE message (that it's "undefined"). Without this message you get a runtime error that could be hard to debug.

if ($_GET['foo']) $bar = 'whatever';

In this example, wrapping the variable in isset() is not strictly equivalent (although it could be sufficient). You would need to use !empty() instead.

$tmp=(isset($_GET[$fld]) ? $_GET[$fld] : "");

In PHP 7.0+ also look at the null coalesce operator (??), that offers a handy shortcut:

$tmp = $_GET[$fld] ?? "";

[csdude55]

I'm absolutely positive that my old VPS didn't have a directory at /home/example/logs. It's gone now, but there's no way it could have been there for 6 years and I never saw it! LOL So I'm guessing that either (a) they had it set for PHP errors to go to a log file that I didn't know existed, or (b) they had changed PHP to ignore warnings and notices.

And that's probably what I'll do, too; change the PHP settings to only print real errors so that my hosting clients accounts don't fill up for what will appear to them to be for no reason. In php.ini:

error_reporting = E_ALL & ~E_NOTICE & ~E_STRICT

and this to ignore duplicates, unless you guys and gals say it's a mistake for some reason:
ignore_repeated_errors = On

Then I can include this in the PHP script that I include on every page of my site, so that I'll continue to get warnings for my own sites:

error_reporting(E_ALL);