Any reason why PHP would'nt see the GET request variables?

Caz

Hi,

i think this may be a matter of configuration; as i've never met this problem on my w2000 dev server; and it now appears on the newly PHP-enabled Solaris server.

As simple as this :

Calling "h t t p://myServer/test.php?link=1"

which contains the following code :

displays a blank page.
$link is considered "unset" (when testing isset($link)😉

I think i should have a look at php.ini and enable what could seem related to auto variable registration or something.

I'll also diff the php.ini from both of my servers.

But maybe i'm totally wrong, so please don't hesitate to give me any clue about this! 🙂

Thanks,
Caz

raymie

I would suspect that the register_globals setting is off, which is the default in recent versions of PHP.

Use a page with phpinfo() in it to check this.

If you need to then you have me able to switch it on via the php.ini file or .htaccess files.

cahva

I suggest to keep the register_globals off and use echo $_GET['link']...

Caz

You got it!
register_global is off.

I've read somewhere that it is recommended to keep it off for security and performance reasons... What are the exact reasons for that?

Will the alternative method http_get_vars work once register_globals is enabled? I'll test this on the w2000.

Either way, i'll have to make a choice : should i keep register_global off on the production server (solaris), and adapt all of my current dev (i should then start by switching off register_globals on the dev server too);
or turn register_globals on on the production server, knowingly openning the security hole i've read about.

Is there a good-sense religion on that matter??

(turning register_globals on everywhere would be my newby choice, but...)

Caz

could you please tell me a little more why exactly this would be your prefered solution?

raymie

register globals is off by default now for security reasons, the main one is to avoid people editing the url and passing in variables via GET which you may not check and actually assume are from a more secure source.

You can use the superglobal arrays to reference the variables

$POST
$GET

etc...

I prefer to use these because that way you know where the values came from (This does not make them any more secure however since the values can still be edited by the user), session variables etc.. are however more secure by referencing them via the $_SESSION array since the contents of that cannot be easily affected by the user unless you have a hole in your security.

I would strongly suggest that you keep the setting off, one of these days it might become the only possible setting in which case you would have to change your code then anyway and it is good practise to get used to it being off now which you are still learning.

Caz

Hm i got the point.

Thank you!