Securing PHP

[nbaxley]

I've been rereading the 4.1.0 release notes and I want to start using the new "special" variable arrays. But, I'm wondering how to tell my code to make the form, and other, variables only available through these arrays. I can use these when I know the variable comes from the user, but it doesn't stop anyone from still overridding some of my other variables. What's the best way to do this? I'm working with a shared hosting situation here, so I can't be recompiling or setting server wide settings, although I'd be interested in knowing about those options.

Thanks,
Nate Baxley

[Anon]

Not sure where the problem is; if you don't trust a variable, don't use it. If you want to use a variable, explicitly set it to some default value before using it. You can get $address to have the same value as $POST['address'] by going $address=$POST['address']. Or you can use the $_POST superglobal exclusively.

You can turn off registry of global variables by starting the script off with a
ini_set('register_globals',0);
This would have the same effect as if this had been a php.ini setting. However, this is off by default, now.