note 111328 deleted from security.globals by danbrown

Note Submitter: Tomasz Dbski at itlublin dot pl ---- @Tumasch wrote good solution, in $_request may be variables with names the same as global variables manually set in script. But more, register_globals defines global variables when session_start() is called, it may be not at beginning of script, but later. Better solution is to define at the very beginning of script such function, and use it instead of session_start() <?php function safe_session_start() { if (ini_get('register_globals') == 1){ // superglobals $local_globals = array(); $super_globals = array( 'GLOBALS', '_SERVER', '_GET', '_POST', '_FILES', '_COOKIE', '_SESSION', '_REQUEST', '_ENV', ); foreach ($GLOBALS as $varname => $varvalue) { // save all global variables except superglobals // which will not be touched even if register_globals is on if (!in_array($varname, $super_globals) $local_globals[$varname] = $varvalue; } $return = session_start(); // register_globals uses these variables $register_global_vars = array ( '_SERVER', '_COOKIE', '_REQUEST', // zawiera łącznie _GET i _POST '_ENV', ); // delete all global variables, except superglobals // and replace them by set earlier globals foreach ($register_global_vars as $remove_me) { if (is_array($$remove_me)) foreach(array_keys($$remove_me) as $varname) { if (!in_array($varname, $super_globals) { if (isset($local_globals[$varname])) { $GLOBALS[$varname] = $local_globals[$varname]; } else unset($GLOBALS[$varname]); } } } } else { $return = session_start(); } return $return; } ?>