Variable Variables ($$var) Risks

TL;DR

Explanation

$$var is PHP's variable variable syntax: $varName = 'username'; $$varName = 'admin' creates $username = 'admin'. This is almost always a design smell and a security risk when $varName comes from user input. Attackers can read or overwrite any variable in scope. Extract() internally uses the same mechanism. Variable variables are occasionally legitimate (template engines, serialisation) but require a strict whitelist. PHPStan flags them as suspicious. In PHP 7, $$var['key'] was disambiguated: ${$var['key']} vs ${$var}['key'].

Common Misconception

Why It Matters

Common Mistakes

• Using $$key from a loop over user-supplied array keys.
• Not whitelisting allowed variable names before using $$var.
• Using variable variables in template code that processes user content.

Code Examples

// User sends: field=password&value=attackerPassword
$field = $_GET['field'];
$$field = $_GET['value']; // Sets $password = 'attackerPassword'

// Whitelist approach:
$allowed = ['title', 'body', 'author'];
$field = $_GET['field'] ?? '';
if (in_array($field, $allowed, true)) {
    $$field = sanitize($_GET['value'] ?? '');
}

// Better: explicit mapping
$data = [
    'title'  => sanitize($_GET['title'] ?? ''),
    'body'   => sanitize($_GET['body'] ?? ''),
];

References

• ↗ https://www.php.net/manual/en/language.variables.variable.php

Tags

Related Terms