Re: How unsafe is register_globals?

Paul Chvostek <paul+php@it.ca> wrote: > > But those are APACHE directives. What I'm looking for is finer-grained > control over what php_flag lines will be accepted. > > A quick test wrapped in a <Directory> APPEARS not to be at risk, but I'd > rather get confirmation of this before I rely on it. this method will soon become a nightmare to administrate. Kinda defeats the purpose using the virtual host stuff. Although sometimes it may be necessary... > > Can someone confirm that mod_php4 will not allow safe_mode and > open_basedir to be altered by php_flag lines in .htaccess files? I knew php had implemented something like this, just took me a while to find it: <quote url="http://us2.php.net/manual/en/configuration.changes.php" > php_admin_value name value Sets the value of the specified directive. This can NOT be used in .htaccess files. Any directive type set with php_admin_value can not be overridden by .htaccess or virtualhost directives. To clear a previously set value use none as the value. php_admin_value open_basedir none php_admin_flag name on|off Used to set a Boolean configuration directive. This can NOT be used in .htaccess files. Any directive type set with php_admin_flag can not be overridden by .htaccess or virtualhost directives. </quote> > > Thanks. > Your welcome. Curt --