Register_globals

[KyanVrezpor]

I don't know what your policy is on changing php.ini settings, but I have a request that register_globals be turned "off" for server 103.

 

Hundreds of PHP security guides on the net cite this as one of the main potential PHP security vulnerabilities, and possibly the most reliable source, the PHP Security Consortium, mentions it first in its guide to security risks.

 

http://phpsec.org/projects/guide/1.html

 

One accidental omission of a definition can open up a whole site, and with register_globals off, this isn't discovered until it is too late.

 

Indeed, register_globals is switched off by default in versions of PHP from 4.2 onwards.

 

I hope that this can be effected.

 

Thanks

[TCH-Rob]

Well, I dont know what they will do in the ticket but you can turn yours off by putting the following in your .htaccess file.

 

php_flag register_globals off

[KyanVrezpor]

Thanks .

 

Where should I put my .htaccess file (I didn't have one to begin with)? Is it OK to have it in the root directory?

[TCH-Thomas]

It should be placed in your public_html I believe.

[TCH-Rob]

Thomas is right.

[KyanVrezpor]

Thanks very much