PHP 4.3 &amp; register_globals

PHP 4.3 & register_globals

Stinger51

Since I've upgraded from PHP 4.1 to 4.3, all of a sudden my variables are not being passed from one form to the next!

For example, I have a selection list box as :

When the user submits the form, "SortBy" should be passed in the $HTTP_POST_VARS global associative array as "$SortBy." But no value for $SortBy is showing up on the next page!

Is there a setting in the php.ini file to enable this? At this point all I can see is the option :

register_globals = Off

However, the comments in the file suggest letting this alone (if I am reading this correctly) as setting this to "On" can cause security problems. Say what? How is it possible then to pass these variables along when the form submits?

Anybody know what the scoop is here?

stolzyboy

read this there is a section about register_globals = Off in there, this is a VERY common problem

Stinger51

Thanks,

I read thru some of that, but I'm still confused. I compared my 4.1 .ini file to the 4.3 file. The only difference that is see is :

register_globals = Off ; 4.3 file

In the 4.1 file this was set to "On." So if I turn this on in the new .ini file to get everything to work properly am I inviting security problems, or not?

Also, why does setting register_globals to "Off" muck up EVERYTHING, meaning I now have to use :

$_Post['varname']

to get the value? This seems wrong to me. Why can't I just use the old :

$varname

as I always did?

I will read back thru all that material again to see if I've missed something, but it ain't light reading. :eek:

ps. Just for the hell of it, I set register_globals to "On" (and restarted Apache) just to see what would happen, and nothing did happen. I still can't use $varname.

Looks to me like it's a different issue, but I'll be damned if I know what.

stolzyboy

if register_globals = Off, you need to access your variables with $POST['var'] from posted forms, $GET['var'] from query string passing of forms with get method

if register_globals = On, you can simply use $var

the reason it is Off by default now is that way you are forced to know where you are getting the variable from, so as not to allow people passing info from the query string for example when you are looking to use a certain variable or some other variable other than what you really are looking for

ahundiak

If you are using $HTTP_POST_VARS for your globals then your script should work regardless of the register_globals setting. Best to leave it off of course but it should not be causing the script to fail.

You might look at the value of something called:
register_long_arrays

This disables the use of $HTTP_POST_VARS.
http://www.php.net/manual/en/language.variables.external.php

It's only supposed to be for PHP5.0 but maybe it crept into your build somehow.

And you might want to make a tiny simple form that just posts one value and confirm that the problem lies with $HTTP_POST_VARS. It's possible that something else might be causing your script to fail. For example, you may be using a global directly and just never noticed it before.

Stinger51

I did try turning on register_globals, but it didn't seem to make any difference. I still have to use the $_POST['varname'] syntax, rather than the more simple $varname.

But I'm not going to worry about that right now, since my web host no doubt (with their imminent PHP upgrade) will no doubt turn that off anyway. Then I will be forced to use the POST syntax when working on-line.

One other question, if I may. I was using the standard :

if (!$PHPSESSID) { go ahead and register your session vars }

but that no longer works. So I tried :

if (!$_POST['PHPSESSID']) { register those session vars }

but the interpreter skipped right over that too. What's the correct way to now check to see if a session has been started? I'm searching thru the on-line manual, but haven't found anything yet.

Tnx again in advance.

stolzyboy

sessions are now access with $SESSION, cookies with $COOKIE, server variables with $_SERVER

Stinger51

I am now using this :

if (!$_SESSION) { register the session vars }

And that seems to work fine, altho I'm not sure it's correct.

But now then, when I go to check for the existence of a session var named $svDirectory (so as not to register it again) with :

if (!$_SESSION['svDirectory'])

or even :

if (!($_SESSION['svDirectory']))

it doesn't seem to find the session var. What's the correct syntax for getting the value of a session variable in the new order of things?

stolzyboy

i usually do this

<?
if ($_SESSION['sessionname'] != "whatever_i_want_it_to")
{
$_SESSION['sessionname'] = "whatver";//set it equal to whatever
}
else
{
do what you want to do if the session is there
}
?>

Stinger51

I finally found the right syntax to determine whether a session var has been registered :

if (!isset($_SESSION['var_name'])) { register the var }

I hope this is the last curve ball that the PHP 4.3 upgrade throws at me! But what the hell, that's the life of a programmer. 😃

TheIceman5

just need to learn how to code properly and youll be fine.

stolzyboy

Originally posted by TheIceman5
just need to learn how to code properly and youll be fine.

pretty sure he doesn't need responses like that, what useless jargon is that

i suppose you were the greatest programmer right when you started

he obviously IS trying to code properly and is asking questions as he goes to learn through his mistakes

that is how you learn

lay off of the smart arse comments

Stinger51

Some of my fellow programmers, when the academic classes were handed out, missed out on Social Skills 101.

I get a lot of answers like the one above, including the old R-T-F-M a lot too. Problem is, a lot of the manuals are written by my fellow programmers, who excel at academics, but again, missed out on English 101. Hence, I see much of their code commented like :

function foobookoo() // A miracle happens here!

and you are expected to read their mind. 😃

I'm hardly a brilliant programmer, and will be the first to admit it. But I am smart enough to know that, rather than spin my wheels for an hour, I'll go to people like yourself who can give me the answer in just a few seconds.

"Ask and ye shall receive. Knock and it shall be opened unto you."

stolzyboy

Originally posted by Stinger51
"Ask and ye shall receive. Knock and it shall be opened unto you." [/B]

Matthew 7:7