RE: [PHP] $_SESSION[] and register_globals=on
| From: | John Holmes | Date: | Fri, 27 Sep 2002 21:42:06 +0000 |
| Subject: | RE: [PHP] $_SESSION[] and register_globals=on | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-117896@lists.php.net to get a copy of this message | ||
> My IP informed me that they have register_globals=on in their php.ini.
Is
> this going to cause problems with my scripts that were written using
> $_POST,
> $_SESSION, etc?
If you can turn it off via, .htaccess, you'd be better. The scripts will
run fine with $_POST or whatever, but realize your open to the
vulnerabilities that made OFF the default. If you use if($value)
anywhere, that value could come from the user. Just something to be
aware of.
Also, with register_globals ON, unregistering a session variable is
tricky. You have to use session_unregister("value") and
unset($_SESSION['value']) and maybe even unset($value); If you don't
ever unregister variables, then you won't have a problem.
---John Holmes...