Registered Globals

[Ultragames]

I've heard alot of people talk abuot keeping Register_Globals off, but my work with SESSIONS would not work unless i had the admin turn it on. Why should it be off, and why wouldnt SESSIONS work with it off?

[Spookster]

It is likely that you were not referring to the sessions in the proper manner. You can use sessions with register globals off.

PHP Code:


session_start();
$_SESSION['myvariable'] = "All Hail Spookster";

echo $_SESSION['myvariable']; 


[Ultragames]

Thats exactly what i do...

But why do people want Register_Globals off?

[raf]

Originally Posted by Ultragames

Thats exactly what i do...

But why do people want Register_Globals off?

because else, not initialising your variables makes your code insecure.

The complete story: http://www.php.net/manual/en/security.globals.php

[Fou-Lu]

If your register globals isn't off, and you haven't taken the proper means to secure your code, your visitor may send variables that you do not want them to. Lets see, for example...

PHP Code:

<?php

if (isset($allowedaccess))
{
    echo "Welcome to the Credit Card Management System.  Click here to proceed";

}
else
{
    header("Location: home.php");
    exit;
    // Return visitor home with no authorizations.
}

So, whats so bad? Well, if register globals is on, and you haven't secured what can pass through your script, in order to access your CC Management system (this is an example, hope nobody has really done something like this...), you would need to send your uri as http://yoursite.com/yourscript.php?allowedaccess=1
Tada, complete control. This is assuming that they know the url and variables required. Sure, there are more simplistic methods around of gathering whats allowed and whats not, but I personally use a global feature with allowed arrays to pass through. The easiest way I can think of to help prevent such attacks if say your register globals are on (which I personally find a lot of servers doing), is to unset whats important. So, at the very beginning the the code snippet, your would have
<?php
unset($allowedaccess);
This way if its sent, its ignored.