note 58543 deleted from function.ini-set by philip

Note Submitter: Alan Hogan ---- You can't use ini_set() to turn off register_globals. They've already been registered. But you can fake it. <?php // Effectively turn off dangerous register_globals without having to edit php.ini if (ini_get(register_globals)) // If register_globals is enabled { // Unset $_GET keys foreach ($_GET as $get_key => $get_value) { if (ereg('^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$', $get_key)) { eval("unset(\${$get_key});"); } } // Unset $_POST keys foreach ($_POST as $post_key => $post_value) { if (ereg('^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$', $post_key)) { eval("unset(\${$post_key});"); } } // Unset $_REQUEST keys foreach ($_REQUEST as $request_key => $request_value) { if (ereg('^([a-zA-Z]|_){1}([a-zA-Z0-9]|_)*$', $request_key)) { eval("unset(\${$request_key});"); } } } ?> (Based on work by Lazur)