note 43250 added to function.ini-set

All the register_globals erasers I've seen so far have been nothing more than a mild barrier to script kiddies :) Use this (I'm putting it in the public domain, it's my code). // assume it's on by default. there was no option to disable // register_globals in PHP3. $register_globals = true; // ini_get is only in PHP4+ if(function_exists('ini_get')) { // We have PHP4, let's find out if register_globals is // enabled. $register_globals = ini_get('register_globals'); } if($register_globals) { // Variables to be protected; may // add automatic detection in the // future, but probably not worth // bothering. Just don't set any // variables (constants are fine) // above this point. $protect_vars = array( 'HTTP_ENV_VARS', 'HTTP_GET_VARS', 'HTTP_POST_VARS', 'HTTP_COOKIE_VARS', 'HTTP_POST_FILES', 'HTTP_SERVER_VARS', 'HTTP_SESSION_VARS', '_ENV', '_GET', '_POST', '_COOKIE', '_FILES', '_SERVER', '_SESSION', 'GLOBALS', 'input_arrays', 'input_array', 'protect_vars' ); // Arrays to loop through for input. // Remember, case sensitive. // By default these are just the arrays // register_globals pulls from. $input_arrays = array( 'HTTP_ENV_VARS', 'HTTP_GET_VARS', 'HTTP_POST_VARS', 'HTTP_COOKIE_VARS', 'HTTP_POST_FILES', 'HTTP_SERVER_VARS', 'HTTP_SESSION_VARS' ); // Just get the values of each item in $input_arrays; // they are the names of the input arrays. while(list(,$input_array) = each($input_arrays)) { // Just get the key names of each item in the input // array; they are the names of the possible variables. while(list($key,) = @each(${$input_array})) { // Variable names are case sensitive (in PHP 5 // at least)..but we don't want people having // variables that get unset just because they // were capitalised wrong in $protect_vars. for($i = 0; $i < count($protect_vars); $i++) { if(strtolower($protect_vars[$i]) == strtolower($key)) { continue 2; } } unset(${$key}); } @reset(${input_array}); } unset($register_globals, $protect_vars, $input_arrays, $input_array, $key, $i); } Make sure you add already defined (within the script) variables to protect_vars...preferably just make sure that this is run before any variables are defined by your script. ---- Manual Page -- http://www.php.net/manual/en/function.ini-set.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+43250 Delete -- http://master.php.net/manage/user-notes.php?action=delete+43250&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+43250&report=yes Search -- http://master.php.net/manage/user-notes.php