note 47617 deleted from security.globals by danbrown

Note Submitter: ben at nullcreations dot net ---- Just a note to all the people who think $_SESSION can be poisoned by register_globals - it can't. Consider the fact that GET/POST/COOKIE is Processed *before* sessions are. This means that even if you have register_globals on, and they write to $_SESSION, $_SESSION will just get reset again with the appropriate values. Some people take to using extract() as a means to simulate register_globals in scripts where they're not sure what the server environment will be - this is when you should worry about such things. The reason is because extract() can concievably occur after GET/POST/COOKIE and SESSION processing.