Re: Form Variables not getting passed || Apache, MySql, Win 2k Setup
| From: | Ernest E Vogelsinger | Date: | Wed, 29 Jan 2003 22:23:46 +0000 |
| Subject: | Re: Form Variables not getting passed || Apache, MySql, Win 2k Setup | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-133559@lists.php.net to get a copy of this message | ||
At 01:36 30.01.2003, CF High said:
--------------------[snip]--------------------
>However, setting register_globals on or off makes no difference. The
>variables are still not getting evaluated........
--------------------[snip]--------------------
I _BET_ it's register_globals.
Did you restart the webserver in case PHP is loaded as a module?
Anyway: it's a lot safer having register_globals set to "off" (see
http://www.php.net/manual/en/security.registerglobals.php#security.registerg
lobals for a discussion on security issues).
For example, assuming that a certain cookie value is available, with
register_globals on this value may be forged by passing the value as part
of the url. A lot of different possibilities arise.
--
>O Ernest E. Vogelsinger
(\) ICQ #13394035
^ http://www.vogelsinger.at/