note 99104 added to security.globals

In response to the many people who have posted suggestions for unregistering globals, these functions are not really secure. For instance, if I submitted the following request: http://www.example.com/?_SERVER=something Then these scripts would all remove $_SERVER, which is not exactly what we would want. A simple workaround, based on bohwaz' code: <?php function unregister_globals($superglobals) { if (!ini_get('register_globals')) { return false; } foreach ($superglobals as $name) { if(isset($GLOBALS[$name])) { foreach ($GLOBALS[$name] as $key=>$value) { if (!in_array($key, $superglobals) && isset($GLOBALS[$key])) unset($GLOBALS[$key]); } } } } $superglobals = array('_POST', '_GET', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES'); unregister_globals($superglobals); ?> ---- Server IP: 69.147.83.197 Probable Submitter: 85.164.200.161 ---- Manual Page -- http://www.php.net/manual/en/security.globals.php Edit -- https://master.php.net/note/edit/99104 Del: integrated -- https://master.php.net/note/delete/99104/integrated Del: useless -- https://master.php.net/note/delete/99104/useless Del: bad code -- https://master.php.net/note/delete/99104/bad+code Del: spam -- https://master.php.net/note/delete/99104/spam Del: non-english -- https://master.php.net/note/delete/99104/non-english Del: in docs -- https://master.php.net/note/delete/99104/in+docs Del: other reasons-- https://master.php.net/note/delete/99104 Reject -- https://master.php.net/note/reject/99104 Search -- https://master.php.net/manage/user-notes.php