RE: [PHP] Re: Using register_globals
| From: | Jay Blanchard | Date: | Wed, 04 Jun 2003 16:31:13 +0000 |
| Subject: | RE: [PHP] Re: Using register_globals | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-150208@lists.php.net to get a copy of this message | ||
[snip]
On Wed, 4 Jun 2003, Jay Blanchard wrote:
> [snip]
> Have register globals set to ON is one way of leaving your script open
> to being exploitable. [/snip]
>
> Please explain this, how does it make it more exploitable? I think
> that this is only true if the code is sloppy.
Correct, if you properly initialize your internal variables there is
nothing insecure about leaving register_globals on.
[/snip]
Then why has there been such a big deal about register_globals security?
Is it because so much code is sloppy?
Thanks!
Jay