security problem in the /fetch/docsauth.php

Hi, There is a security problem in the new script to authenticate users in our site. The problem is that register_globals is on in the master server, so I could hack the script and login myself :) Just do something like: http://master.php.net/fetch/docsauth.php?_SERVER[REMOTE_ADDR]=**server_ip**&token=**token**&credential=a_magic_cookie And you can use the script. And the token shouldn't be a md5/sha hash?... Nuno