Re: Register Globals Query

On Wednesday 30 April 2003 19:09, caspar kennerdale wrote: [snip] > whilst is is the more secure to have register globals turned off and forces > a stricter programming style, very few isp's have turned it off themselves > (or havent upgraded). if mainitaining your own server fine, but when > maintaining on behalf of clients then the ball is in the isp court! You can minimise the security risks by initialising any variable you use. > Or even better, there are functions so you can do a > > foreach ($_GET as $key => $value) { > $test = $key . "=" . $value; > parse_str($test); > } > > and then you'd have all your get vars as normal variables... Which kind of defeats the purpose of disabling register_globals. Read the chapter on Security. -- Jason Wong -> Gremlins Associates -> www.gremlins.biz Open Source Software Systems Integrators * Web Design & Hosting * Internet & Intranet Applications Development * ------------------------------------------ Search the list archives before you post http://marc.theaimsgroup.com/?l=php-general ------------------------------------------ /* If you do not think about the future, you cannot have one. -- John Galsworthy */