note 21493 added to security.registerglobals

Disabling register_globals on the php.ini level is much easier said than done, especially when you have a very large user base that has come to reply upon its presence. Something more practical would be to use a code snippet like this: // UNSET all magic_quotes_gpc values that have been globalized. foreach ($HTTP_GET_VARS AS $pram=>$value) { unset($$pram); } $safe_get_vars = array("action", "session"); foreach ($safe_get_vars AS $key) { $$key = $HTTP_GET_VARS[$key]; } You can do the same for POST and COOKIE vars. You shouldn't have to worry about session vars, as they can not be injected via GPC. This method allows you to filter input, and allow only those expected values which can be passed via GET or POST. Don't forget that this is __NOT__ a substitute for validating the input that you receive. You can live with register_globals and magic_quotes_gpc enabled, however it requires smart programming. You need to work with cases, versus allowing the direct input from the web to spawn an event. -- http://www.php.net/manual/en/security.registerglobals.php http://master.php.net/manage/user-notes.php?action=edit+21493 http://master.php.net/manage/user-notes.php?action=delete+21493 http://master.php.net/manage/user-notes.php?action=reject+21493