View Full Version : Registered Globals

10-19-2004, 05:05 AM
I've heard alot of people talk abuot keeping Register_Globals off, but my work with SESSIONS would not work unless i had the admin turn it on. Why should it be off, and why wouldnt SESSIONS work with it off?

10-19-2004, 06:00 AM
It is likely that you were not referring to the sessions in the proper manner. You can use sessions with register globals off.

$_SESSION['myvariable'] = "All Hail Spookster";

echo $_SESSION['myvariable'];

10-19-2004, 07:35 AM
Thats exactly what i do...

But why do people want Register_Globals off?

10-19-2004, 10:15 AM
Thats exactly what i do...

But why do people want Register_Globals off?
because else, not initialising your variables makes your code insecure.

The complete story: http://www.php.net/manual/en/security.globals.php

10-19-2004, 12:17 PM
If your register globals isn't off, and you haven't taken the proper means to secure your code, your visitor may send variables that you do not want them to. Lets see, for example...


if (isset($allowedaccess))
echo "Welcome to the Credit Card Management System. Click here to proceed";

header("Location: home.php");
// Return visitor home with no authorizations.

So, whats so bad? Well, if register globals is on, and you haven't secured what can pass through your script, in order to access your CC Management system (this is an example, hope nobody has really done something like this...), you would need to send your uri as http://yoursite.com/yourscript.php?allowedaccess=1
Tada, complete control. This is assuming that they know the url and variables required. Sure, there are more simplistic methods around of gathering whats allowed and whats not, but I personally use a global feature with allowed arrays to pass through. The easiest way I can think of to help prevent such attacks if say your register globals are on (which I personally find a lot of servers doing), is to unset whats important. So, at the very beginning the the code snippet, your would have
This way if its sent, its ignored.