Discuss Register Globals (How It Works) in the PHP Development forum on Dev Articles. Register Globals (How It Works) PHP Development forum to discuss anything related to developing applications in PHP. Topics include architecture, coding standards, and debugging methods.
Posts: 785
Time spent in forums: 2 h 34 m 21 sec
Reputation Power: 11
Register Globals (How It Works)
I've realized that way too many PHP developers just don't understand the register_globals setting.
Here are some notes ( I didn't feel an official article was necessary, so this will have to do ):
1. You can turn on/off register_globals from PHP.INI, .htaccess and httpd.conf using php_value directive, php_flag
2. You can't set register_globals on/off during runtime
3. $_GET, $_POST, $_SESSION, $_COOKIE, etc are called superglobals and are globally accessible. (yes, even from functions).
4. $HTTP_GET_VARS, $HTTP_POST_VARS, etc are predefined variables like the superglobals, yet these are not in the same namespace nor are they globally accessible.
5. Using $varname instead of $_GET['varname'] or $_POST['varname'] can potentially be dangerous to your scripts... but that depends on how you are using them. It isn't necessarily the end of the world if you do, but I suggest you don't. Not just for security, but for compatible, portable, and clean code.
Take a look at a sample I put together just for all those who need a quick pointer in the right direction:
In the example you will find two links.
Both are just a list of variables from the $_GET and $HTTP_GET_VARS array's which PHP has predefined at runtime.
One is in a directory where register_globals is turned off, and the other has register_globals on.
Take a look at all the variables, but definately make note of the var_dumps that are highlighted with color. You will notice that there are multiple ways to access this info.
This example helped me to clarify a while ago that using the superglobal array's is a much cleaner way to program in PHP. It was either take the manual's word for it or test it out myself.
__________________
__________________________________________________ _
Wil Moore III, MCP | Integrations Specialist | Senior Consultant Are You Listed...? | DigitallySmooth Inc.
Posts: 650
Time spent in forums: 1 h 48 m 34 sec
Reputation Power: 0
Re: Register Globals (How It Works)
Quote:
Originally posted by laidbak 3. $_GET, $_POST, $_SESSION, $_COOKIE, etc are called superglobals and are globally accessible. (yes, even from functions).
You forgot $_SERVER, $_FILES, $_ENV, and $_REQUEST
Here's a good link that has examples of all of the superglobals
Posts: 123
Time spent in forums: < 1 sec
Reputation Power: 11
stupid question!
do the super globals also work when register_globals is off. so is it good practice to always use them. I think that is what will was saying but i just want to make sure.
Posts: 111
Time spent in forums: < 1 sec
Reputation Power: 11
Yes, when register_globals is off you have the superglobal ($_GET, $_POST) and the "old" server variable ($HTTP_GET_VARS, $HTTP_POST_VARS) arrays.
The only thing you don't get with register_globals turned off, are automatically extracted variables coming in from GET and POST. (e.g. $_POST[userid] doesn't automatically show up as $userid. And this is a good thing, because you want to control where such variables can come from.
Sure, register_globals sounds convenient, but it comes at a price. A simplistic example:
With register_globals it's possible that a hacker could access your restricted area by injecting variables through the URL. If your script checks for the existence of variables without knowing where they come from, that could mean trouble. For example, accessing yoursite/restricted.php?loggedin=1 would lead to a variable called $loggedin existing in the script. Simply checking if ($loggedin) would be a poor safeguard.
Posts: 589
Time spent in forums: < 1 sec
Reputation Power: 12
Hey Wil,
Nice work your post definetly sheds light on the globals in PHP. Personally, I think that they've just confused everyone by adding the $_XXX variables and depreciating the $HTTP_POST_VARS (for example) array.
Anyway, just 1 thing that no one has mentioned. For those of you working with older scripts, or trying to run with register_globals off on a newever version of PHP (such as 4.3), you need to declare the older arrays as global if the scope you're using is a function, such as:
<?php
function test()
{ global $HTTP_GET_VARS;
$x = $HTTP_GET_VARS["x"];
echo $x;
}
test();
?>
Make sure you add the "global..." line. This stands true for any of the depreciated arrays such as $HTTP_POST_VARS, $HTTP_SERVER_VARS, etc...
Posts: 785
Time spent in forums: 2 h 34 m 21 sec
Reputation Power: 11
Hey Mytch,
Thanks for the feedback.
I should have included that... I guess I left it out because I tend to not use the global statement anywhere in my scripts.
I just grepped a bunch of my code to see if I could really make that claim... yup, I haven't used it anywhere in anything I have on my box at the moment.
Everything I do is without the use of declaring globals of any kind.
A buddy of mine asked me recently how I would get the value of the server's root path into a function... My answer was:
Code:
define('ROOT_DIRECTORY', $_SERVER['DOCUMENT_ROOT']);
function getRoot()
{
return ROOT_DIRECTORY;
}
print 'Root is : '.getRoot();
Posts: 1,355
Time spent in forums: < 1 sec
Reputation Power: 12
Just thought of something else I posted in another thread that probably goes well here too. Though I don't advocate this usage as a common practice, it could help get some people out of a jam. Imagine a scenario in which somebody has to change hosts, and the new host doesn't support register_globals=on, but the code's all written with variables unscoped. As a quick fix to get the site up and running until a code conversion can be done, the following code might come in handy:
PHP Code:
while(list($k,$v)=each($_POST)){
$$k=$v; //Yes, that's two dollar signs.
}
It loops through the $_POST array and, for each key, creates a variable whose name corresponds to that key, and assigns the associated value to the new variable.
Again, I think it's important to scope your variables properly if only to make your code legible to other developers, but if you find yourself in a pinch, this might help you out in the short term.
Posts: 1
Time spent in forums: < 1 sec
Reputation Power: 0
PHP 4.3.x with IIS 5.1
Developers FYI : I tried IIS 5.1 with P 4.3.1 using isapi, and variables posted on the page never worked. I changed the port on IIS to a different one (ie: 8080) and voila, it worked!. Anybody knows if this can be worked without changing the port. I tried everyting (dif combinations): registering globals on INI, tryed $_POST['var'], $_GET['var'], $_REQUEST['var'] etc... and nothing retreived the values or echoed them. Only when I changed the Port IIS worked fine.
I understand Apache and Xitami work well with PHP and don't have this problems. By the way I am using XP service pack 2.
Regards to list.
Quote:
Originally Posted by laidbak
In that case why not try:
PHP Code:
extract(array_merge($_POST,$_GET));
This creates a variable for each key in the post and get arrays. You can do this with the cookies array and session array if you like.
Posts: 9
Time spent in forums: < 1 sec
Reputation Power: 0
Using Depreciated Code
I have sometimes needed to use outdated code that has register globals turned on... For one reason or another the files were mixed with files that used the $_REQUEST format.
Security wan't an issue as this part of the system was in an intranet and the old files all loaded a common include file. So we found out that we could turn on register globals during run-time with
Posts: 1,030
Time spent in forums: 1 Week 12 h 34 m 39 sec
Reputation Power: 10
Also remember, that the availability of the 'long' arrays like $HTTP_POST_VARS[] also depends on the 'register_long_arrays' setting in php.ini.
The only really sure way nowadays are the $_POST, etc superglobals.
As for populating the 'normal' variables yourself, you'll still have to check whether the variable is set before you use it, so I prefer to have sections like this at the start of code that uses post/get data:
PHP Code:
if(isset($_POST['var1']))
$var1 = $_POST['var1'];
else
$var1 = ""; ##### Set default value
if(isset($_GET['var2']))
$var2 = $_GET['var2'];
else
$var2 = 0; ##### Set default value
This way, you're always sure the variable is set with a legal value, saving a lot of checking later on.
__________________ This is my code. Is it not nifty?
"The biggest problem encountered while trying to design a system that was completely foolproof, was, that people tended to underestimate the ingenuity of complete fools."
---Douglas Adams
Posts: 1
Time spent in forums: 9 m 32 sec
Reputation Power: 0
Thanks for the feedback.
I should have included that... I guess I left it out because I tend to not use the global statement anywhere in my scripts.
I just grepped a bunch of my code to see if I could really make that claim... yup, I haven't used it anywhere in anything I have on my box at the moment.
Everything I do is without the use of declaring globals of any kind
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
your post definetly sheds light on the globals in PHP. Personally, I think that they've just confused everyone by adding the $_XXX variables and depreciating the $HTTP_POST_VARS (for example) array.
PHP 4.3.x with IIS 5.1
Using Depreciated Code
Linear Mode
