note 111328 added to security.globals

@Tumasch wrote good solution, in $_request may be variables with names the same as global variables manually set in script. But more, register_globals defines global variables when session_start() is called, it may be not at beginning of script, but later. Better solution is to define at the very beginning of script such function, and use it instead of session_start() <?php function safe_session_start() { if (ini_get('register_globals') == 1){ // superglobals $local_globals = array(); $super_globals = array( 'GLOBALS', '_SERVER', '_GET', '_POST', '_FILES', '_COOKIE', '_SESSION', '_REQUEST', '_ENV', ); foreach ($GLOBALS as $varname => $varvalue) { // save all global variables except superglobals // which will not be touched even if register_globals is on if (!in_array($varname, $super_globals) $local_globals[$varname] = $varvalue; } $return = session_start(); // register_globals uses these variables $register_global_vars = array ( '_SERVER', '_COOKIE', '_REQUEST', // zawiera łącznie _GET i _POST '_ENV', ); // delete all global variables, except superglobals // and replace them by set earlier globals foreach ($register_global_vars as $remove_me) { if (is_array($$remove_me)) foreach(array_keys($$remove_me) as $varname) { if (!in_array($varname, $super_globals) { if (isset($local_globals[$varname])) { $GLOBALS[$varname] = $local_globals[$varname]; } else unset($GLOBALS[$varname]); } } } } else { $return = session_start(); } return $return; } ?> ---- Server IP: 69.147.83.199 Probable Submitter: 83.28.129.125 ---- Manual Page -- http://php.net/manual/en/security.globals.php Edit -- https://master.php.net/note/edit/111328 Del: integrated -- https://master.php.net/note/delete/111328/integrated Del: useless -- https://master.php.net/note/delete/111328/useless Del: bad code -- https://master.php.net/note/delete/111328/bad+code Del: spam -- https://master.php.net/note/delete/111328/spam Del: non-english -- https://master.php.net/note/delete/111328/non-english Del: in docs -- https://master.php.net/note/delete/111328/in+docs Del: other reasons-- https://master.php.net/note/delete/111328 Reject -- https://master.php.net/note/reject/111328 Search -- https://master.php.net/manage/user-notes.php