Register Globals

[phpforfun]

hey guys, so I have always coded my sites with register globals on, thus this site I use now is setup that way.

I just joined ToastedPenguin.com, and it has it turned off, I doubt it can be turned on for just one user... anyone know of a script I an inject to turn them on?

Justin

[phpforfun]

looking through my code, there is hundreds and hundreds of variables id need to edit and change $variable to $_GET['variable']

and some of them are from either, like login is a POST method, but the action is login, so you click login and the url is ?action=login, then you submit and it sends the POST information with $login, $username, $password..

[phpforfun]

HAH! Found an emulator

PHP Code:

<?php
// Emulate register_globals on
if (!ini_get('register_globals')) {
    $superglobals = array($_SERVER, $_ENV,
        $_FILES, $_COOKIE, $_POST, $_GET);
    if (isset($_SESSION)) {
        array_unshift($superglobals, $_SESSION);
    }
    foreach ($superglobals as $superglobal) {
        extract($superglobal, EXTR_SKIP);
    }
}
?>

[Jordan]

You can turn this on in your .htaccess file as well. Add:

 php_flag register_globals on

In your .htaccess file.

[John]

Since this server is running phpSuExec, I don't believe php flags can be set in the .htaccess file - they need to be set as directives in a personal php.ini file, in the directory the flags should be set. However, phpforfun should note, not using variables of the form $_POST and $_GET is a security risk as forms can be easily spoofed. Which is the reason why the server has them disabled by default.

[phpforfun]

its not that much of a risk, show me a script has them turned off, and I can secure it with them on

[John]

Originally Posted by phpforfun

its not that much of a risk, show me a script has them turned off, and I can secure it with them on

And your the one writing a book on PHP security?

[phpforfun]

Originally Posted by John

And your the one writing a book on PHP security?

nope, how about you?

[John]

I am - if you buy one, I will autograph it for you

[phpforfun]

Originally Posted by John

I am - if you buy one, I will autograph it for you

You wrote the book on PHP security?! well I wrote the book on writing books on php security, want me to autograph yours?