#21015 [Opn]: phpweb isn't register_globals safe

ID: 21015 Updated by: goba@php.net Reported By: toni.viemero@iki.fi Status: Open Bug Type: Website problem Operating System: Irrelevant PHP Version: 4.3.0RC3 New Comment: You are somewhat right. But as you see search.php for example, it is not ideal to replace all uses of $pattern with $_REQUEST['pattern']. It is more ideal to first assign the $pattern variable the value of $_REQUEST['pattern']. I am on updating the pages, and this will probably be done on a page per page bases. Today's focus was a rewrite of the search page, which is now more logical. This rewrite also helped to start some other things, like the new code in prepend.inc to make those shorthand arrays accessible even on mirror sites with PHP version < 4.1.0. The setting you request to include on mirroring.php is of course there since some time now, but regardless of that I am at least a bit motivated to make the php.net scripts nice and register_globals = off friendly, but it's not a quick process to do that... BTW I have fixed the undefined constant problem on search.php it was just there today in my new code... => intentionally leaving this bug open, so we won't forget about it ;) Previous Comments: ------------------------------------------------------------------------ [2002-12-14 12:31:17] toni.viemero@iki.fi At least on the following documents giver errors running phpweb register_globals off: include/site.inc downloads.php error/index.php $REMOTE_HOST, $DOCUMENT_ROOT, $SERVER_NAME etc. should be replaced with $_SERVER["..."] etc. Or change mirroring.php to indicate this for future mirrors ("php_value register_globals on" in virtualhost config). Surfing phpweb with error_reporting(E_ALL) errors too like this one: Use of undefined constant NO_BASE - assumed 'NO_BASE' in search.php on line 15. IMHO PHP.net website should represent itself as somehow working example of "error-free" (as in site works perfectly without needing to go backwards compatible from present php.ini default values) php coding :) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=21015&edit=1