note 14461 deleted from security.registerglobals.php by ronabop

:-) :-) :-) Good Lord! No wonder so many users are thinking that they can just turn off register_globals and use HTTP_xxx_VARS and all their user-input data is "safe". NO, NO, NO, NO. It is *TRIVIAL* for a script-kiddie to edit their Cookie files or your HTML FORM and send you whatever COOKIE or POST data they want. And even Joe Sixpack and Betsy Buick can look at a URL and start playing around with it to see what they can break into. All this register_globals and HTTP_xxx_VARS stuff will provide is a minimal barrier to the dumbest of the dumb. Do *NOT* rely on this as making user-input data "safe". You *MUST* sanitize any and all user-input data no matter what its source: GET/POST/COOKIE. Reality-Check. This page has a *LOT* of people thinking they can tweak their php.ini file and their site is safe... All the above will do is make a (very) small curb for the assault vehicles to climb over as they pound on your site. It's not even a curb worth building, IMNSHO, since: Efficacy as hack-prevention is minimal Barrier to code readability is high, increasing maintenance/bugs You can't over-ride POST/GET on purpose for development/testing You can't easily have one script handle two interfaces, POST & GET. Newbies have to understand arrays to do anything useful. Ewwwww! Your script is essentially a big function, which should only care about the quality of the data, not where it comes from. REPEAT: The procedure outlined here is a teeny, tiny curb in your defense that will only filter out the stupidest malicious users -- You *MUST* sanitize incoming data anyway to stop anybody with half a clue. :-) :-) :-)