note 16790 added to language.variables.predefined

Although the following is touched on in this section, it is worth emphasizing. For those of you who are interested in bulletproofing your PHP code by turning the "register_globals" directive off (a good idea), PHP will not overwrite any environment variable names with field names encountered in submitted forms (GET or POST). For example, if you have a form with an input field named "HTTP_POST_VARS", it's posted value WILL NOT overwrite the $HTTP_POST_VARS environment variable. If fact, it will create it as a value in the $HTTP_POST_VARS array with the field name as the key =>$HTTP_POST_VARS['HTTP_POST_VARS']. Even if the register_globals directive is turned on, the $HTTP_POST_VARS variable will not be overwritten. This prevents crackers from spoofing these variables and creating problems in your code. Keep in mind though, you can still explicitly change the value of these environment variables from within a page. i.e., $SERVER_NAME = 'foo' will change the $SERVER_NAME environment variable, but submitting a form variable named 'SERVER_NAME' will not. -Jim -- http://www.php.net/manual/en/language.variables.predefined.php http://master.php.net/manage/user-notes.php?action=edit+16790 http://master.php.net/manage/user-notes.php?action=delete+16790 http://master.php.net/manage/user-notes.php?action=reject+16790