note 66349 added to security.globals

If you have a webhost with register_globals On by default, and running PHP as CGI (not as an Apache module, when there might be some solutions) use the code bellow. Explanation: it will first take all global variables, and unset everything that shouldn’t be there. Do not worry about your code still being accesible for changes (i.e. info.php?_ENV[OS]=NewOS ). The PHP queue works like this: first it registers variables from GET, etc. and then it fills in the global variables _GET, _POST, etc. (I wonder why they are not READ ONLY!) Therefore you will have the correct associative arrays, without any injected modification. <?php if (ini_get('register_globals')) { foreach($GLOBALS as $s_variable_name => $m_variable_value) { if (!in_array($s_variable_name, array('GLOBALS', 'argv', 'argc', '_FILES', '_COOKIE', '_POST', '_GET', '_SERVER', '_ENV', '_SESSION', 's_variable_name', 'm_variable_value'))) { unset($GLOBALS[$s_variable_name]); } } unset($GLOBALS['s_variable_name']); unset($GLOBLAS['m_variable_value']); } ?> Full article here: http://andreineculau.wordpress.com/?s=register_globals * the above code is not mine. I found it on the Internet, while I was looking for a solution. ---- Server IP: 212.93.155.36 Probable Submitter: 141.85.172.144 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/security.globals.php Edit -- http://master.php.net/note/edit/66349 Del: integrated -- http://master.php.net/note/delete/66349/integrated Del: useless -- http://master.php.net/note/delete/66349/useless Del: bad code -- http://master.php.net/note/delete/66349/bad+code Del: spam -- http://master.php.net/note/delete/66349/spam Del: non-english -- http://master.php.net/note/delete/66349/non-english Del: in docs -- http://master.php.net/note/delete/66349/in+docs Del: other reasons-- http://master.php.net/note/delete/66349 Reject -- http://master.php.net/note/reject/66349 Search -- http://master.php.net/manage/user-notes.php