Turning off register_globals

[ovi]

As I have been learning the ins and outs of PHP, I have come across some cool tricks that you can do when you are running PHP on Apache (as most of you are, I bet). In a hosted environment, one does not usually have access to the PHP.ini file. Oftentimes the default settings are not appropriate for what you are doing, so we need a way to change those settings for your application. Here is where Apache steps in.

Using the .htaccess file, you can set values for the PHP engine to use at runtime. It is really quite simple to do. The following is the format:

# in Apache files, pound-signs ("#") comment out a line...

# to set a boolean value
php_flag setting_name on|off

# to set any other values
php_value setting_name setting_value

The most common thing that I set is the register_globals flag. When register_globals is on, all variables from the query string (GET), all variables from forms (POST), and (I'm pretty sure) all variables from cookies are automatically available as local variables. That is, if you have a query string like "index.php?fuseaction=home.main&foo=bar&stan=cox", in the PHP page, you can access them as $fuseaction ("home.main"), $foo ("bar"), and $stan ("cox"), if register_globals is turned on. That may be just fine for your purposes, and it certainly can make your coding easier.

However, I think it is a little sketchy to allow users to directly affect variables in your script, so I ALWAYS turn it off. Like so:

php_flag register_globals off

Ovi

 

[Duke]

I'm just curious but doesn't disabling this feature make it impossible to link to a certain topic within a forum because the url's are now all the same or am I just misunderstanding the message?