Menu
Community /Pin to ProfileBookmark
@NogDogOct 29.2005 — #The problem is that orginally PHP tended to be installed with register_globals turned on. Then it was realized that this can result in some undesirable things happening, both from a coding aspect and a security aspect. So now the default installation (and I would say the recommended installation) is to have register_globals turned off. Unfortunately, if you work with older scripts or scripts distributed by those today who don't realize the problem this causes, it can be annoying.
But if in all your scripts you always refer to GET and POST inputs via the $_GET and $_POST arrays, then it does not matter whether the particular installation you run it on has register_globals turned on or off. I realize that doesn't make life any easier dealing with legacy scripts, but at least it will prevent you from passing the disease on to others. ?@NogDogOct 29.2005 — #When a form submits data via the post method, the values from the form fields are stored in an array called $_POST, with the array keys being the names of the form elements. So if you have a form with input elements named "one", "two", and "three"; when submitted to a PHP script their values are accessible as $_POST['one'], $_POST['two'], and $_POST['three']. If register_globals is turned on, they are also accessible as $one, $two, and $three. So my point is, the $_POST['name'] variable is there regardless of the register_globals setting, so you can always count on it working. The $name alternative only works if register_globals is turned on, so it cannot be depended upon to work in any installation. So, for maximum portability of your scripts you should always assume that register_globals will be turned off, and you should therefore always reference the post data via the $_POST array (or get data via the $_GET array).@NogDogOct 29.2005 — #
http://www.php.net/manual/en/security.globals.php
Installing PHP? Confused…
Hell all!, I’m an absolute newbie to PHP and backend scripting in general. I would like to learn the language on a local environment, so i installed IIS on win xp and downloaded php from php.net. So after all that I started to crack my tuturial and start learning, but now i notice that when I view my php files in a browser, i get the notice of undefined errors. I’m guessing that has to do with register_global?? My real question is, do PHP coders, who work locally deal with the crappy output that occurs with register_global off? or do they switch it on? And if they do switch it on…how?!? Or do they simply test on a rental host server? Thanks in advance!
Sign in
to post a comment9 Comments(s) ↴
0
@NogDogOct 29.2005 — #The problem is that orginally PHP tended to be installed with register_globals turned on. Then it was realized that this can result in some undesirable things happening, both from a coding aspect and a security aspect. So now the default installation (and I would say the recommended installation) is to have register_globals turned off. Unfortunately, if you work with older scripts or scripts distributed by those today who don't realize the problem this causes, it can be annoying.But if in all your scripts you always refer to GET and POST inputs via the $_GET and $_POST arrays, then it does not matter whether the particular installation you run it on has register_globals turned on or off. I realize that doesn't make life any easier dealing with legacy scripts, but at least it will prevent you from passing the disease on to others. ?
0
@NogDogOct 29.2005 — #When a form submits data via the post method, the values from the form fields are stored in an array called $_POST, with the array keys being the names of the form elements. So if you have a form with input elements named "one", "two", and "three"; when submitted to a PHP script their values are accessible as $_POST['one'], $_POST['two'], and $_POST['three']. If register_globals is turned on, they are also accessible as $one, $two, and $three. So my point is, the $_POST['name'] variable is there regardless of the register_globals setting, so you can always count on it working. The $name alternative only works if register_globals is turned on, so it cannot be depended upon to work in any installation. So, for maximum portability of your scripts you should always assume that register_globals will be turned off, and you should therefore always reference the post data via the $_POST array (or get data via the $_GET array).0
@NogDogOct 29.2005 — #how do u turn register_globals on? and what do they mean, it poses a security. How would that apply to my desktop pc and iis?[/QUOTE]