Re: Re: Using register_globals

It's true that register_globals being on only makes sloppy code more insecure. Most people aren't going to write perfect code, though. It's incredibly annoying to have to unset every variable that shouldn't be from an outside source. Even if you do so, it's very likely that you will forget one variable on one page. It will, of course, be the variable allowing admins to blow up a nuclear bomb over New York. :) Jay Blanchard wrote:

[snip] Have register globals set to ON is one way of leaving your script open to being exploitable. [/snip] Please explain this, how does it make it more exploitable? I think that this is only true if the code is sloppy. Thanks! Jay

-- The above message is encrypted with double rot13 encoding. Any unauthorized attempt to decrypt it will be prosecuted to the full extent of the law.