Register Globals

[John]

Originally Posted by phpforfun

You wrote the book on PHP security?! well I wrote the book on writing books on php security, want me to autograph yours?

I am in the process of writing it

[Jordan]

Originally Posted by John

Since this server is running phpSuExec, I don't believe php flags can be set in the .htaccess file - they need to be set as directives in a personal php.ini file, in the directory the flags should be set. However, phpforfun should note, not using variables of the form $_POST and $_GET is a security risk as forms can be easily spoofed. Which is the reason why the server has them disabled by default.

This is true. .htaccess will not work with phpSuExec but you can define your own php.ini file in your home directory.

[phpforfun]

Originally Posted by Jordan

This is true. .htaccess will not work with phpSuExec but you can define your own php.ini file in your home directory.

ok, thats new to me, but ill look into it.

[phpforfun]

how do I define the php.ini file?

[Surgeon]

Why not just use: ini_set() at the top of your script(s)?

PHP: ini_set - Manual

Theres other functions there that may also help with your configuration problems.

[John]

Originally Posted by phpforfun

how do I define the php.ini file?

Make a file called php.ini and add the php directive Jordan described earlier. You should note, that registered globals will be removed in PHP 6. So, sooner or later you will have to switch to the superglobal array format - why not now?

Originally Posted by Surgeon

Why not just use: ini_set() at the top of your script(s)?

PHP: ini_set - Manual

Theres other functions there that may also help with your configuration problems.

Setting registered globals at run time will be of little use since, by the time the script runs, the globals have already been set.

[phpforfun]

well I just tried to change my code with the globals off, and it gets way too complicated, most of my site would be using $_GET, but then for a few things it uses $_POST, such as sending in a testimony, or signing up on the site.

They may take that function off in php6, but the code I posted to emulate it would still work