Re: Using register_globals=on with $_SESSION['var']?

Thanks Jason, When you say 'minimise the risk' - you mean it would still be possible to inject variables using globals on and say, $_SESSION['username']? All $_SESSION['xxxx'] are initialized and validated, and all form input/output is done through SSL. I don't understand how that could be accomplished by a malicious person. Could you explain a bit? Tia, Andre On Saturday 03 May 2003 04:59 am, Jason Wong wrote: > On Saturday 03 May 2003 10:20, Andre Dubuc wrote: > > I designed my site with register_globals="off" and used $_POST['var'] > > or > > $_SESSION['var'] throughout. However, I am thinking of switching my IP, > > and the new IP has register_globals set to 'on'. > > > > My question: what security issues should I be concerned about if I left > > it the way it is, and use $_POST['var'] or $_SESSION['var'] throughout > > with register_globals="on"? > > > > I would greatly apprciate any input, advice, or warnings about my > > proposed course of action. > > By initialising variables you'll minimise the risk of malicious people > injecting variables when you have register_globals enabled. > > -- > Jason Wong -> Gremlins Associates -> www.gremlins.biz > Open Source Software Systems Integrators > * Web Design & Hosting * Internet & Intranet Applications Development * > ------------------------------------------ > Search the list archives before you post > http://marc.theaimsgroup.com/?l=php-general > ------------------------------------------ > /* > Make me look like LINDA RONSTADT again!! > */