Re: How unsafe is register_globals?

On Wed, Jul 16, 2003 at 11:42:29PM -0500, Jonathan Villa wrote: > > This is only my stubborn opinion... > > I would turn it on for now with a warning that it will be turned off > soon... At least in my case, it's never been on in the past, and the queries are coming from folks who want me to change it from its current OFF state. > From: Chris Shiflett [mailto:shiflett@php.net] > Sent: Wednesday, July 16, 2003 11:22 PM > > So, I would turn it on if I were in your situation, or rather, I would allow > them to override the default settings via a .htaccess file (assuming Apache). Perhaps that's where I need advice. Currently, a .htaccess file with: php_flag register_globals on gets the error "php_flag not allowed here". I see from the comments at http://www.php.net/register_globals that I need AllowOverride Options to make that function ... but is it possible to have fine-grained enough an AllowOverride statement that only register_globals can be changed? I wouldn't want a user to use his .htaccess file to turn off safe_mode or open_basedir. -- Paul Chvostek <paul@it.ca> Operations / Abuse / Whatever it.canada, hosting and development http://www.it.ca/