Re: Security Issues

On Sat, 28 Jul 2001, Zeev Suraski wrote: > Anyway, to be more constructive - Andi had an idea when we were catching a > cab earlier today (yesterday). His idea (which I'm just pitching, we > haven't thought this through at all yet) is that instead of having > register_globals on, or off, we would have it as unset, by default. When > unset (i.e., on new installations) - PHP will not run, but instead display > information about register_globals, its security implications, examples, > and a general recommendation to turn it off if at all possible. I think one issue here is that people are so used to using certain kind of language syntax that they're simply overestimating the effort of typing $_{GET,POST}['foo'] when needed. With some time to get used to it, I think most of the people will see why this is a good idea. Your idea sounds like something that might help with this. One thing that would further this cause would be to explain how to start converting your existing codebase to be more secure in small chunks. I have no experience with other web servers than Apache, but with Apache I use for my own homepages a .htaccess similar to the one below. I have similar settings for many virtual hosts and directories in the server configuration files. # Security php_flag register_globals Off # Error tracking / displaying / logging php_value error_reporting 2047 php_flag display_errors Off php_flag log_errors On php_value error_log '<REPLACE_ME>' php_flag track_errors On > Zeev -- <----------------------------------------------------------------------> Heikki Korpela -- heko@iki.fi -- http://iki.fi/heko/