simple question about register_globals

[m_tt]

Say I have:

<!--- global.inc --->
$myVar = "globalVar";

<!--- index.php --->
include("global.inc");
echo $myVar;

Does this require register_globals to be on? Is there a more secure method of doing this? $_GET['myVar'] maybe?

I know that say "index.php?myVar=globalVar" would require register_globals to be on but what if the global variable is in an include file?

Thanks,
Matt

[ahundiak]

As long as you explicitly initialize your globals before using them (which is what you did) then it's ok. Your initialization will override anything register_globals may have done.

It's the unitialized globals that can cause problems because then a user might set the value from a url.

[m_tt]

Lets say the linking code looks like this:
index.php?myVar=curValue

So which is a better method to use?

if (!$myVar) {
 ## myVar is not set...
} else {
 ## myVar is set...
}

-- or --

if (!$_GET['myVar']) {
 ## myVar is not set...
} else {
 ## myVar is set...
}

[ahundiak]

Always use $_GET for url variables.