Re: Add Warning to PHP Security Advisory

> Upgrading to 4.2+ changes the default setting of register_globals in the > php.ini file. How did I find this out? When none of my variables were > being passed, I went to check the pre-defined variables page on PHP.net > and found my answer. > > Why was/is this not in the security alert? Because this is not the case. PHP does not modify your existing php.ini file in any way whatsoever. If you had register_globals=on in your php.ini file then nothing changed. The default, if not specified in your php.ini file did change, but this is not new in 4.2.2, this was changed in 4.2.0 where a big deal was indeed made of it in the release notes. And this 4.2.2 was only a required secutiry update if you were already running 4.2.0 or 4.2.1. So all around you plain just didn't read before upgrading. -Rasmus