Re: security benefits of predefined variables

Kirk, That was enlightening, thank you. I think that I had better set register_globals OFF ! However there is still one last nagging question in my mind: What is the purpose of the $_GET (or $HTTP_GET_VARS) predefined variable? It seems that in the case of "get" variables, malicious variables could still be set in the querystring and even using $_GET['variablename'] wouldn't be able to stop this from happening. That is, from what I understand, the advantage of using "get" variables in the first place. So does using $_GET actually confer any additional security? If so, how? Thank you all, Erik On Tuesday, January 15, 2002, at 03:55 PM, Johnson, Kirk wrote:

Give this a read first, then come back if you still have questions ;) http://www.securereality.com.au/studyinscarlet.txt Kirk

-----Original Message----- From: Erik Price [mailto:pricee@hhbrown.com] Sent: Tuesday, January 15, 2002 1:50 PM To: PHP Subject: [PHP] security benefits of predefined variables Hi, I was hoping that someone could point me to a page or resource where I can find more information about using the predefined variables introduced in PHP 4.1.0.