note 10286 rejected and deleted from Filesystem Security by jmoore

One problem I'm having as a newbie understanding php security is that it depends so heavily on seemingly small config changes. For example, consider the comments above about HTTP_REMOTE_USER. If register_globals is set, a cracker can simply pass HTTP_REMOTE_USER as a GET variable; more generally, the cracker can initialize any variable at all. Moral: a PHP script should never count on *any* value for an environment or HTTP_* variable.