Re: Lost feature - variables_order/register_globals mess

Rasmus Lerdorf wrote:

In this whirlwind hack job to turn off register_globals, we have lost a very useful feature. Or maybe it was lost earlier and I didn't pay attention. Today you cannot set variables_order to "ES" and turn register_globals on so that only E and S vars end up in the global symbol table. If you do this, then there is no way to get to G, P and C variables. $HTTP_GET_VARS/$_GET do not get populated anymore when there is no G in variables_order, for example.

This should be fixed :)

This is a rather big shame as populating the global symbol table with at least the server variables is a pretty safe thing to do. It's ok that variables_order can be used to speed things up and tell PHP not to hash stuff into the various arrays, but the approach of partially filling globals and fetching the rest from the appropriate arrays is useful. So, I think we either need a new directive along the lines of force_hashing = "GPC" or we need to simply always hash. Or perhaps it would be a negative subtracting directive like: never_hash = "E"

It would be a lot easier for PHP application developers if they can assume GPCS are always hashed into $_GET, $_POST, $_COOKIE and $_SERVER. ($_ENV also?) How about make "variable_order" affects only for globals? I guess current code always initializes global symbol, then initializes track vars. How about change this to initizlize track vars always, then initilize global vars? -- Yasuo Ohgaki