note 42274 deleted from security.globals by philip

Note Submitter: Matt AKA Junkie ---- Think of this situation: you're writing an open-source program and there comes the threat of whether or not the end-user will have register_globals off because many free and still many paid hosts have it on by default. Using ini_set() might seem like a good idea, but it doesn't always work. Instead, it's better to just unset all possible global variables (like $PHP_SELF for example). <? $globals = array('_GET', '_POST', '_SERVER', '_FILE', '_COOKIE', '_SESSION'); // add more as desired foreach ($globals as $i => $val) { foreach ($$val as $j => $var) { if (isset($$var)) { unset($$var); } } } // This will unset any potential globals registered ?>