Re: GET, POST, REQUEST

From: Date: Sun, 18 Jun 2006 07:19:20 +0000
Subject: Re: GET, POST, REQUEST
References: 1 2 3 4 5  Groups: php.general 
Request: Send a blank email to php-general+get-238217@lists.php.net to get a copy of this message
----- Original Message ----- From: "Rory Browne" <rory.browne@gmail.com>
Good code won't be vulnerable to register_globals either, but having register_globals on is a security problem because there are security flaws that can only be exploited when register_globals is enabled.
Actually, code quality cannot overcome the vulnerability of register_globals. Every program will have global variables. register_globals=on may overwrite a valid global variable, one totally unrelated to user input, with a value coming from the request, and there is nothing good coding can do about it. The chances that an external user might hit the right variable name are slim (unless a disgruntled former programmer) but they exist. Satyam

« previous php.general (#238217) next »