If you have a query string like this:
http://www.server.com/dir/hello.php?foo=1&bar=2
Then you can get to the foo and bar values by accessing $foo and $bar, IF REGISTER_GLOBALS IS ON. However, this is a security problem. Let's say you have the following code for the page http://www.server.com/info.php:
if ($logged_in = "1") {
header("Location: http://www.server.com/securepage.php");
} else {
header("Location: http://www.server.com/loginpage.php");
}
If register_globals is ON, all a hacker has to do to get to the secure page is type in http://www.server.com/info.php?logged_in=1 and he's looking at your secure page.
If you turn OFF register_globals, then the hacker won't be able to pass in the variable as easily if you use cookies or a post. To access the variable yourself, you retrieve it like so:
$logged_in = $POST['logged_in'];
or
$logged_in = $COOKIE['logged_in'];
For more information about this topic, check the following link. Be sure to read the full discussions... there is some valuable information there as well:
Using Register Globals (php.net)
The reason many sites have register_globals = ON is that prior to 4.1.0, that was the default setting. Because of this, many coders used global variables in their code, and even though they have upgraded their servers, it would take too much effort and time to go through all of their code fixing the variables.
My STRONG suggestion to you is this: If you are installing PHP new, leave the default register_globals to OFF. Even if you are coding pages on a server with it set to ON, code your pages as if it were off. Your pages will be more portable, much more secure, and most important, will not break once the register_globals setting is OFF in the future.
