Check this code:
<?php
session_start();
if ($username == 'kevin' and $password == 'secret')
{
$authorized = true;
session_register('authorized');
}
?>
<?php
if (!$authorized)
{
//Display HTML Form prompting user to log in
}
else
{
//Super-secret HTML content goes here
}
?>
With register globals on, If the users writes in the URL ?authorized=1 security is bypassed because of the global scope of $authorized.
As fo register_globals OFF this can't be done, you would then have this code:
<?php
session_start();
if ($POST['username'] == 'kevin' and
$POST['password'] == 'secret')
{
$_SESSION['authorized'] = true;
}
?>
<?php
if ( !$_SESSION['authorized'] )
{
//Display HTML Form prompting user to log in
}
else
{
//Super-secret HTML content goes here
}
?>
This way your security hole is gone, using register_globals off!
🙂
