Re: HTTP_*_VARS and REGISTER_GLOBALS

Hi Bernie! On Fri, 15 Sep 2000, Bernie Huang wrote: > Hi, > > Just a few questions. I turned REGISTER_GLOBALS on in php.ini, so all > EGPCS vars can be accessed globally. Are there any advantage of turning > it off? yes, for a quick one check the latest security advisory on uploaded files. you may find it handy to have your variables aready filled, but this is a "bad practice"[tm]. You are using something you don't know for sure where it's coming from, so you are exposed to security risks. > If yes, I am trying to use HTTP_*_VARS with REGISTER_GLOBALS off so that > the scripts are more clear and organized. The problem is that I already > have a lot of scripts written under the "REGISTER_GLOBALS on" mode. Is > there a easier way to change the scripts instead of modifying every > global vars to $HTTO_*_VARS[*] in each script under the > "REGISTER_GLOBALS off" mode? you can add at the very begining of those scripts something like: extract ($HTTP_*_VARS); where `*' meets the name of the array holding the variables you are using. -- teodor