set register_globals to off - HOW?

LonelyPixel

hi there,
i have i little problem with my php code...
generally, it's written in a way that any setting of register_globals, magic_quote_gpc and all the other stuff won't matter. i think, this stable (and sometimes a little complex) coding is needed to create an application that can be run just anywhere without any environment modification 🆒

but one thing won't work yet, when register_globals is set 'on' (as is often at isps nowadays):
i have a $SESSION variable called 'user', and it contains the currently logged in user, this is a string. now i have one page that makes use of the variable $user in file scope, which has an array with more information on that user in it. no problem with reg_glob's = off, works absolutely fine - but when it's on, this $user simply overwrites my $SESSION['user'].

i had to apply some tricks at common initialization time of my app, like unquoting all those incoming arrays and setting some ini values more friendly to my app. but what i'd like to do is ini_set('register_globals', 0); which won't work. that's documented so, i know.

but there must be a chance to avoid my application to overwrite some essential SESSION vars just by setting around some variables... does it? if anyone out there knows what i mean and has a solution for that, please let me know.

ah, ya, i'm using php as cgi, so i can't set any .htaccess values or so. and i'd like to let reg_globs set to on as long as i anyhow can. it's going to be a webhosting server, and i know many hobby programmers out there who just don't care about that, so i want to 'help' them a little with that. (not interested in too many php help requests saying my server wouldn't work...)
the other app is a bulletin board, that absolutely must be compatible to such environments, but i don't use the same vars' names there, for my luck...

stolzyboy

Where are you getting your other $user from? A form, the URL, etc...

LonelyPixel

the $user is set from within my own script
ok, now i could just go and avoid using variable names that are already taken from the SESSION array, but that's kind of annoying, when i always have to look if it could be the case......

stolzyboy

well you don't have to do that, just use $GET['user'] if you get it from the url or use $POST['user'] if you get it from submitting a form, that way PHP can tell the difference from a session user var and either a get or post user var

LonelyPixel

mh, i think you didn't get this right now...

i have a $SESSION variable called 'user', ok so far.
but i also had (changed this now) a variable $user in my script, that didn't come from the outside, no GET, no POST or anything like this. it's just a line of code assigning a new value to the previously unused (at least by me) variable $user. i acually don't need this variable before and after this area of code, as i access the SESSION variable exclusively through $SESSION['user']. i know this is the only way with reg_globs=off.

but my problem is (was) now that the name '$user' is permanently linked with $SESSION['user'] and i can't seem to unlink it in a way that $user=...; won't change $SESSION['user'], too. that's the point for me.

and with this problem i'd always have to look if the variable's name (i may want to use anytime) is already taken for the SESSION array. but this array is filled from many different places, so it's kind of a problem finding them all or displaying it at the top of every page so that i can see them.

i merely want $user and $_SESSION['user'] (with 'user' being any name) to be something different, just as one could expect it.

dave2k

you can overide the default globals setting by creating a .htaccess file and including this in it:

php_flag safe_mode off
php_value max_execution_time 30000000

hope this helps

Weedpacket

Originally posted by LonelyPixel
...line of code assigning a new value to the previously unused (at least by me) variable $user. i acually don't need this variable before and after this area of code, as i access the SESSION variable exclusively through $SESSION['user']. i know this is the only way with reg_globs=off.

Well, it certainly shouldn't be, unless you're using session_register('user') somewhere - and for reasons much like what you've just discovered, mixing that and $SESSION[] is a bad thing.

I've never seen behaviour like what you're apparently describing:
(register_globals=on)

session_start();
$user = 'foo';
echo $_SESSION['user'];

returns empty, unless I gave $_SESSION['user'] a value - and then it returns 'foo' only if that's what was actually sessioned.

In short, $user and $_SESSION['user'] are completely independent. Even if I turn register_globals on. But not if I session_register('user'), of course.

It's easy enough to write code that works whether register_globals is on or off: just always write as if it's off.