register_globals

[tweenerz]

Could someone explain to me what having register_globals turned on does and why it is a security risk?

I realize that is turns server and environment variables into ready-to-use variables in your script, but that is the limit of my knowledge on the subject. I don't understand why that is a risk.

Thanks

 

[sleipnir214]

The PHP online manual has a very good discussion of this very topic:

http://us2.php.net/manual/en/security.globals.php

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[nawlej]

For one,it could allow user entered text to be potentially mailicous by having globals off.

___________________________________
[morse]--... ...--[/morse], Eric.

 

[tweenerz]

Thanks sleipnir.

So it is mainly a programmer issue. If the programmer develops stable and well defined code, it doesn't matter what register_globals is set to. It is when you start assuming values that you get into trouble.

 

[sleipnir214]

There are additional reasons not directly related to security that the link I posted doesn't cover.

One is portability. If you write your code assuming that register_globals is "off", you code will still run on another system that has that value set to "on". The converse is not true.

Another is maintainability. Six months after you've written a piece of code, you may not remember how the value got into $username -- and the chance of this happening increase with code complexity and time. But $_POST['username'] will be self-evident.



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[tweenerz]

Very true.

My only concern was that if I coded as if register_globals was off, was there still a security issue. And I gather the answer is no.

So the moral of the story is - 'Assume register_globals is off and you should be fine.'

 

[sleipnir214]

'Assume register_globals is off and you should be fine.'

Well, "fine" may be a little strong. You're certainly in a better position than assuming otherwise.



Want the best answers? Ask the best questions!

TANSTAAFL!!