Coding with register_globals OFF?

Akito

I want to learn to code with register_globals OFF, but some of my scripts pass quite a few variables (up to about 80) which would be a complete pain to code by hand (right now I've got a catch all type script).

How do you code with register_globals off and still have the ease of use of it being on? Or should I Just leave it on (my host does) and not worry about it?

stolzyboy

if you want it off, and still don't want to change a lot of variables in your code, try using extract(), simple put this before you have to access post variables and/or get variables

extract($POST); // for post methods
extract($GET); //for get methods

these will extract all posted or get variables in your script

but the best way is to change your code, IMHO

CaptianChaos

One thing you can do to make it just like register globals is on is to drop this at the top of your code (although this is not recommended, you're better off learning to code with register globals off):

stolzyboy method is better... this is pretty much what extract does anyway, though:

<?php

while ( list ($key, $val) = each ($_COOKIE)) {
  ${$key} = $val;
}
while ( list ($key, $val) = each ($_GET)) {
   ${$key} = $val;
}
while ( list ($key, $val) = each ($_POST)) {
  ${$key} = $val;
}

Weedpacket

Of course, with both methods you've now got several dozen variables floating around and who knows what their names are - they're no longer all bundled together into the same place (i.e., the $GET[] or $POST[] array) from which nice convenient lists can be made. Which is frankly easier to work with (especially when you pass lots of variables) than having them spattered all over the global namespace.

Akito

Using
extract($POST); // for post methods
extract($GET); //for get methods

made it so I could turn the register globals off but not have to modify my script.

Thanks a ton!

Weedpacket

If you're going to extract $GET and $POST then there's no point turning register_globals off in the first place - you're just doing by hand what register_globals did automatically. Bit of a waste of time, that.

Akito

So, instead you suggest using $_GET['variable name']; ?

BTW, what is the purpose of learning to code with them off in the first place?

laserlight

You would probably apply some sort of check to the given variable before setting it to a form (i.e. without the array name) that is easier to handle.

Things like is_numeric(), using stripslashes or addslashes() depending on what you need etc.

RedDragon

hi check out this thread:

http://www.phpbuilder.com/board/showthread.php?s=&postid=10285799

stolzyboy

Originally posted by Akito
So, instead you suggest using $_GET['variable name']; ?

BTW, what is the purpose of learning to code with them off in the first place?

so your code is universal, meaning it won't matter what server you put it on, regardless if register_globals is on or off

and yes it is better to use $GET, $POST, $SESSION, $COOKIE, $_FILES

to get your values, i was merely showing you how to do this to get your current scripts to work on an "off" server so you can go ahead and code with it "off" now

Akito

So it's not a security hole then?

stolzyboy

i guess i wouldn't say security hole persay, but it is a lot easier
for peeps to do insertion attacks, gain access to admin
(sessioned) pages, etc.... when register_globals is On, so i would
suggest to code with it OFF whenever possible, even if the server is set to ON.

Akito

Alright, then all future php I write will conform to this standard!

If I have any other q's I'll be sure to ask 🙂