note 99104 deleted from security.globals by danbrown

Note Submitter: frxstrem ---- In response to the many people who have posted suggestions for unregistering globals, these functions are not really secure. For instance, if I submitted the following request: http://www.example.com/?_SERVER=something Then these scripts would all remove $_SERVER, which is not exactly what we would want. A simple workaround, based on bohwaz' code: <?php function unregister_globals($superglobals) { if (!ini_get('register_globals')) { return false; } foreach ($superglobals as $name) { if(isset($GLOBALS[$name])) { foreach ($GLOBALS[$name] as $key=>$value) { if (!in_array($key, $superglobals) && isset($GLOBALS[$key])) unset($GLOBALS[$key]); } } } } $superglobals = array('_POST', '_GET', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES'); unregister_globals($superglobals); ?>