note 47617 added to security.globals

Just a note to all the people who think $_SESSION can be poisoned by register_globals - it can't. Consider the fact that GET/POST/COOKIE is Processed *before* sessions are. This means that even if you have register_globals on, and they write to $_SESSION, $_SESSION will just get reset again with the appropriate values. Some people take to using extract() as a means to simulate register_globals in scripts where they're not sure what the server environment will be - this is when you should worry about such things. The reason is because extract() can concievably occur after GET/POST/COOKIE and SESSION processing. ---- Manual Page -- http://www.php.net/manual/en/security.globals.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+47617 Delete -- http://master.php.net/manage/user-notes.php?action=delete+47617&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+47617&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+47617&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+47617&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+47617&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+47617&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+47617&report=yes Search -- http://master.php.net/manage/user-notes.php