Register_Globals Enabled?

[carbonize]

I was just messing about with some code and it told me that register_globals is enabled on my server, matra. Just wondering if this is true and if so why? Last I checked register_globals is disabled by default for extra security.

[TCH-Bruce]

I'd open a ticket with the help desk. You can always turn it off in the .htaccess file.

 

>php_flag register_globals off

[carbonize]

Thanks have disabled them now. Just seems strange having them enabled.

[TCH-Dick]

Thanks have disabled them now. Just seems strange having them enabled.

 

This is one of those things we occasional review and have tested a few times over the years. Unfortunately, due to the varying skill levels of site owners and how often they change/update their code, these test have never went well. They have always ended in an overwhelming number of broken sites and angry webmasters. Therefore, we continue to come to the conclusion that disabling register globals by default is just not feasible.

 

With that said, it is my understand that register_globals is being deprecated as of PHP 5.3.0 and will be completely removed in PHP 6.

[carbonize]

Yes you are right in regards to it being removed in PHP 6. I would personally just send all your customers an email saying that you are disabling register globals at a set date and that way they have plenty of time to update their scripts. Most scripts they have obtained would of been updated anyway (hopefully) and possibly contain security fixes. If it's their own script then they need to get off their backsides and fix them anyway.