note 103216 added to security.globals

In some cases you might need to register globals, and in other cases you simply don't want to register all variables by hand. Sure, it's best that variables are registered otherwise you will get PHP notices in your logs. Here is a simple way of registering variables without too much typing and still have a reasonable secure set of variables that will not trigger Undefined indexes as a notice. <?php function __register($method,$keys,$type='string',$secure) { // maximum iteration. defined('MAX_ROUND') or define('MAX_ROUND', 200); // custom reserved variables $reserved_custom = array('login_email', 'session', 'include', 'require', 'this', 'var', 'static'); // not a security feature: preventing possible mistakes. $reserved_default = array('_SERVER', '_REQUEST', '_GET', 'POST', '_COOKIE', '_FILES', '_SESSION', '_GLOBALS', 'GLOBALS', 'PHPSESSID', 'PHP_SELF','_', 'DOCUMENT_ROOT', 'SCRIPT_FILENAME', 'PHP_AUTH_USER', 'PHP_AUTH_PW','$'); $ignoredglobs = array_merge( $reserved_default, $reserved_custom ); function __string($str) { // your custom security return htmlspecialchars(trim($str),ENT_QUOTES,'UTF-8'); } function __sqlstr($str) { // your custom security return mysql_real_escape_string(trim($str)); } $n = count($keys); if($n>=1 && $n <= MAX_ROUND) { foreach($keys as $value) { $returnvalue = (in_array($value,$ignoredglobs)) ? false : ($method == 'REQUEST') ? (isset($_REQUEST["$value"])) ? $_REQUEST["$value"] : '' : ($method == 'GET') ? (isset($_GET["$value"])) ? $_GET["$value"] : '' : ''; $GLOBALS["$value"] = ($secure == true) ? ($type == 'string') ? __string($returnvalue) : __sqlstr($returnvalue) : $returnvalue; unset($value); // unset the foreach value, otherwise it will maintain it. } } return; } // Usage: simply register our variables with one call __register('REQUEST',array('page','news'),'string',true); // Output shows that the index has been set: echo $page; ?> ---- Server IP: 69.147.83.197 Probable Submitter: 82.171.76.240 ---- Manual Page -- http://www.php.net/manual/en/security.globals.php Edit -- https://master.php.net/note/edit/103216 Del: integrated -- https://master.php.net/note/delete/103216/integrated Del: useless -- https://master.php.net/note/delete/103216/useless Del: bad code -- https://master.php.net/note/delete/103216/bad+code Del: spam -- https://master.php.net/note/delete/103216/spam Del: non-english -- https://master.php.net/note/delete/103216/non-english Del: in docs -- https://master.php.net/note/delete/103216/in+docs Del: other reasons-- https://master.php.net/note/delete/103216 Reject -- https://master.php.net/note/reject/103216 Search -- https://master.php.net/manage/user-notes.php