Re: Register globals off, still not secure?
| From: | Daniel Clark | Date: | Fri, 30 Apr 2004 17:58:58 +0000 |
| Subject: | Re: Register globals off, still not secure? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-185068@lists.php.net to get a copy of this message | ||
Yes. My understanding turning globals off stops using $PHP_AUTH_PW directly.
> Hi, Even with register globals off isn't it possible to have a webpage
> like this:
>
> <html>
> <head>
> </head>
>
> <h2>Hello, <?php echo $_SERVER['PHP_AUTH_USER']; ?>
> <p>I know your password is <?php echo $_SERVER['PHP_AUTH_PW']; ?>
>
> <body>
> </body>
> <html>
>
>
> Is there a way to make sure apache doesn't set the $SERVER['PHP_AUTH_PW
> '] global?
>
> Thanks.
>
> --
> /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
> Patrick Hutchinson phutchin@cisco.com
> Engineering Web Systems Administrator 408.527.0305 direct
> Cisco Systems, Inc. 408.527.2313 fax
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>