register_globals on for sessions

[mstringham]

What is the risk of keeping register_globals on when using PHP sessions? PHP.net suggests security issues. And are the old session functions depricated in favor of $_session['var'] functions?

Thanks

Mark

[nightowl]

it is explained on the site of PHP what the security issues might be. However, I didn't find them very convincing and unless you really need to rely on the security of your site (which is rarely the case), just turn them on again.

[smook]

agreed with nightowl - although there has been a big push to keep them on it is no substitute to good coding practice...

sm

[Lurk]

I leave it off but I'm a n00b so what would I know... LOL 😉

Seriously though, if you only want register globals on for html forms, it's so easy to get the vars by using

$var = $_GET["var"];
$var = $_POST["var"]; 

or if for some reason you want the lot, just do

extract($_GET);
extract($_POST);