note 66349 deleted from security.globals by philip
| From: | philip@php.net | Date: | Wed, 28 Feb 2007 16:35:51 +0000 |
| Subject: | note 66349 deleted from security.globals by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-123957@lists.php.net to get a copy of this message | ||
Note Submitter: andrei dot neculau (0) gmail dot com
----
If you have a webhost with register_globals On by default, and running PHP as CGI (not as an Apache
module, when there might be some solutions) use the code bellow.
Explanation: it will first take all global variables, and unset everything that shouldnât be
there. Do not worry about your code still being accesible for changes (i.e. info.php?_ENV[OS]=NewOS
). The PHP queue works like this: first it registers variables from GET, etc. and then it fills in
the global variables _GET, _POST, etc. (I wonder why they are not READ ONLY!) Therefore you will
have the correct associative arrays, without any injected modification.
<?php
if (ini_get('register_globals'))
{
foreach($GLOBALS as $s_variable_name => $m_variable_value)
{
if (!in_array($s_variable_name, array('GLOBALS', 'argv', 'argc',
'_FILES', '_COOKIE', '_POST', '_GET', '_SERVER',
'_ENV', '_SESSION', 's_variable_name', 'm_variable_value')))
{
unset($GLOBALS[$s_variable_name]);
}
}
unset($GLOBALS['s_variable_name']);
unset($GLOBLAS['m_variable_value']);
}
?>
Full article here: http://andreineculau.wordpress.com/?s=register_globals
* the above code is not mine. I found it on the Internet, while I was looking for a solution.