RE: [PHP] How unsafe is register_globals?

> -----Original Message----- > From: Paul Chvostek [mailto:paul+php@it.ca] > Sent: 17 July 2003 16:55 > > But those are APACHE directives. What I'm looking for is > finer-grained > control over what php_flag lines will be accepted. > > A quick test wrapped in a <Directory> APPEARS not to be at > risk, but I'd > rather get confirmation of this before I rely on it. > > Can someone confirm that mod_php4 will not allow safe_mode and > open_basedir to be altered by php_flag lines in .htaccess files? Go look at the big table at http://www.php.net/ini-set. open_basedir and safe_mode are both listed as PHP_INI_SYSTEM which, if you look at the smaller second table near the end of the page, means that they are settable only in php.ini or httpd.conf. Cheers! Mike --------------------------------------------------------------------- Mike Ford, Electronic Information Services Adviser, Learning Support Services, Learning & Information Services, JG125, James Graham Building, Leeds Metropolitan University, Beckett Park, LEEDS, LS6 3QS, United Kingdom Email: m.ford@lmu.ac.uk Tel: +44 113 283 2600 extn 4730 Fax: +44 113 283 3211