Re: Re: [PHP-DB] Re: sessions
| From: | John Holmes | Date: | Sat, 11 Dec 2004 15:30:33 +0000 |
| Subject: | Re: Re: [PHP-DB] Re: sessions | ||
| Groups: | php.db | ||
| Request: | Send a blank email to php-db+get-37671@lists.php.net to get a copy of this message | ||
> From: Joseph Crawford <codebowl@gmail.com>
>
> correct me if i am wrong but i have been told it is bad and insecure
> to use register_global=on
You are wrong. :)
Having register_globals OFF helps to prevent poorly written programs from being vulnerable to users
setting variables in the URL/header/cookie data. You can still write horribly insecure programs with
register_globals OFF. You can easily write very secure programs that function with register_globals
ON or OFF, too.
---John Holmes...
UCCASS - PHP Survey System
http://www.bigredspark.com/survey.html