designse
04-25-2005, 09:40 AM
when i turn it on, what will happend?
![]() | View Full Version : what is "register_globals" in php.ini designse 04-25-2005, 09:40 AM when i turn it on, what will happend? X-TechMedia 04-25-2005, 10:00 AM If you don't know what it does, you probably shouldnt be playing with php.ini! From the following: http://builder.com.com/5100-6371_14-5272345-2.html the register_globals variable, the cause of much heartache to longtime PHP developers. In PHP 3.x, this variable was On by default, leading form variables to be automatically converted to PHP variables when a form was submitted. Security concerns led to this variable being set to Off in PHP 4.x. As a result, form variables could only be accessed through the special $_GET and $_POST arrays. This broke many scripts written in PHP 3.x, and forced developers to rewrite and retest their scripts. For example, the value entered into the field <input type="text" name="email"> would be available as $email in a PHP 3.x script, but as $_POST['email'] or $_GET['email'] in a PHP 4.x script. You should generally set this variable to Off, as that offers greater security against script attacks through forms. For compatibility with older PHP 3.x scripts, turn it On designse 04-25-2005, 10:14 AM ok thank you! Rich2k 04-25-2005, 12:22 PM The problem actually came down to people not knowing how to secure their scripts even with register globals on. This is why it has to be moved the super global arrays to protect those who didn't have the first clue about programming securely! |