note 103216 deleted from security.globals by danbrown

Note Submitter: Sasha van den Heetkamp ---- In some cases you might need to register globals, and in other cases you simply don't want to register all variables by hand. Sure, it's best that variables are registered otherwise you will get PHP notices in your logs. Here is a simple way of registering variables without too much typing and still have a reasonable secure set of variables that will not trigger Undefined indexes as a notice. <?php function __register($method,$keys,$type='string',$secure) { // maximum iteration. defined('MAX_ROUND') or define('MAX_ROUND', 200); // custom reserved variables $reserved_custom = array('login_email', 'session', 'include', 'require', 'this', 'var', 'static'); // not a security feature: preventing possible mistakes. $reserved_default = array('_SERVER', '_REQUEST', '_GET', 'POST', '_COOKIE', '_FILES', '_SESSION', '_GLOBALS', 'GLOBALS', 'PHPSESSID', 'PHP_SELF','_', 'DOCUMENT_ROOT', 'SCRIPT_FILENAME', 'PHP_AUTH_USER', 'PHP_AUTH_PW','$'); $ignoredglobs = array_merge( $reserved_default, $reserved_custom ); function __string($str) { // your custom security return htmlspecialchars(trim($str),ENT_QUOTES,'UTF-8'); } function __sqlstr($str) { // your custom security return mysql_real_escape_string(trim($str)); } $n = count($keys); if($n>=1 && $n <= MAX_ROUND) { foreach($keys as $value) { $returnvalue = (in_array($value,$ignoredglobs)) ? false : ($method == 'REQUEST') ? (isset($_REQUEST["$value"])) ? $_REQUEST["$value"] : '' : ($method == 'GET') ? (isset($_GET["$value"])) ? $_GET["$value"] : '' : ''; $GLOBALS["$value"] = ($secure == true) ? ($type == 'string') ? __string($returnvalue) : __sqlstr($returnvalue) : $returnvalue; unset($value); // unset the foreach value, otherwise it will maintain it. } } return; } // Usage: simply register our variables with one call __register('REQUEST',array('page','news'),'string',true); // Output shows that the index has been set: echo $page; ?>