note 48576 deleted from security.globals by aidan
| From: | aidan@php.net | Date: | Sat, 15 Jan 2005 12:57:18 +0000 |
| Subject: | note 48576 deleted from security.globals by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-83315@lists.php.net to get a copy of this message | ||
Note Submitter: david at net2ftp dotcom
----
If you want register_globals to be Off in one script, but you can't change the PHP config
(shared hosting) and you can't use a .htaccess directive (shared hosting, or non-Apache
server), this may help.
Here is a easy script which will erase all auto-registered variables, except for $_GET, $_POST,
$_COOKIE, etc.
<?php
if (ini_get(register_globals) == 1) {
$defined_vars = get_defined_vars();
while (list($var_name, $var_value) = each($defined_vars)) {
if ($var_name != "_GET" && $var_name != "_POST" && $var_name
!= "_COOKIE" && $var_name != "_SERVER" && $var_name !=
"_FILES" && $var_name != "_SESSION" && $var_name !=
"_ENV") {
unset($$var_name);
}
} // end while
}
?>
To check if the variables were really unset, use this:
<?php
$defined_vars = get_defined_vars();
while (list($var_name, $var_value) = each($defined_vars)) {
echo "Variable " . $var_name . " has value " . $var_value . "<br
/>\n";
} // end while
?>
Once all auto-registered variables are unset, you can register only the ones you really want:
$username = $_POST["username"];