Register globals off, still not secure?
| From: | Patrick Hutchinson | Date: | Fri, 30 Apr 2004 15:37:15 +0000 |
| Subject: | Register globals off, still not secure? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-185048@lists.php.net to get a copy of this message | ||
Hi, Even with register globals off isn't it possible to have a webpage like this:
<html>
<head>
</head>
<h2>Hello, <?php echo $_SERVER['PHP_AUTH_USER']; ?>
<p>I know your password is <?php echo $_SERVER['PHP_AUTH_PW']; ?>
<body>
</body>
<html>
Is there a way to make sure apache doesn't set the $SERVER['PHP_AUTH_PW '] global?
Thanks.
--
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
Patrick Hutchinson phutchin@cisco.com
Engineering Web Systems Administrator 408.527.0305 direct
Cisco Systems, Inc. 408.527.2313 fax