Bug #16308 Updated: unregister_globals() - a function that removes all vars by "register_globals"

ID: 16308 Updated by: tapken@engter.de Reported By: tapken@engter.de Status: Bogus Bug Type: Feature/Change Request Operating System: Linux 2.4 PHP Version: 4.1.2 New Comment: For security reasions i can't use .htaccess for configuring php. >and how do you think unregister_globals() should be able to distinguish >between variables set by "register_globals" and those by the user? I wrote "called at the beginning of a script". At this time there should not be any variables created by the user. Previous Comments: ------------------------------------------------------------------------ [2002-03-27 09:01:03] daniel@php.net you can set register_globals = off on a vhost base with php_value in your httpd.conf and slowly migrate each user to the new config. ------------------------------------------------------------------------ [2002-03-27 08:58:16] daniel@php.net and how do you think unregister_globals() should be able to distinguish between variables set by "register_globals" and those by the user? this will more like lead to a big mess. why not just switch it off? ------------------------------------------------------------------------ [2002-03-27 08:31:59] tapken@engter.de Hi all! The new globals vars ($_GET, $_POST, etc) are very nice but they do not bring more security if register_globals = on. Regrettably, many server admins are unable to set "register_globals = off" due to the fact that many scripts would broke. I would like to see a 'unregister_globals()'-Function (called at the beginning of a script) which parses the gpc-vars and unsets all normal vars with the same name (let's say it undoes register_globals' work). It would be nice if somebody would inform me if he has such a patch. bye, Roland ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=16308&edit=1