RE: [PHP] Re: Using register_globals
| From: | Rasmus Lerdorf | Date: | Wed, 04 Jun 2003 16:27:40 +0000 |
| Subject: | RE: [PHP] Re: Using register_globals | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-150207@lists.php.net to get a copy of this message | ||
On Wed, 4 Jun 2003, Jay Blanchard wrote:
> [snip]
> Have register globals set to ON is one way of leaving your script open
> to being exploitable.
> [/snip]
>
> Please explain this, how does it make it more exploitable? I think that
> this is only true if the code is sloppy.
Correct, if you properly initialize your internal variables there is
nothing insecure about leaving register_globals on.
-Rasmus