register_globals master local

AndrewPHP

Hello,

I noticed that there are two columns in the output of phpinfo: "master" and "local". What is the difference between these two columns and where can I read about this in the PhP documentation? I was unable to find this in the PhP Docs.

(I was looking at phpinfo output because I wanted to verify that register_globals is off. The phpinfo() output showed the master version as being on and the local version as being off. Is there a way I can programatically verify that register_globals is off, so that the program can exit immediately if it's on?)

Andrew

BuzzLY

First of all... Master means the settings from the server (php.ini, httpd.conf, etc). A different value under Local means a setting has been changed with an .htaccess file.

Second: To get the value of register_globals, use this (and stay with me here... it's a really difficult one to remember 😉):

ini_get('register_globals');

Lastly, you don't need to programmatically exit a program just because register_globals is set. You should ALWAYS access your post, get, and cookie variables using $POST, $GET, and $COOKIE (or the $HTTP_VARS equivalents). If you always use them, then your code will work regardless of where it is, and malicious hackers won't be able to "trick" your programs by using GET variables.

AndrewPHP

Thank you.

In the program I am interested in there are only two places that I know where I get user input: once from _GET[] and once from getenv(). The latter I call user input because I'm told it could be spoofed. Since I do not understand the scope of register_globals, and if register_globals is set then something is seriously wrong since it means I am not using the version of PHP that I thought, I figured I would exit the program if it were set.

BuzzLY

Where are you getting this user input? From a form? Unfortunately, the form tag defaults to the GET method. All you need to do is set the method to post, and your subsequent page will have access to the variables via the $_POST array. For example:

Page 1 (input.php):

<form name="myform" action="output.php" method="post">
<input type="text" name="name">
<input type="submit" value="submit" name="submit">
</form>

Page 2 (output.php):

<?php
$name = $_POST['name'];
echo "Hello, $name";
?>

Obviously, those are only partial pages, but they should illustrate my point. Now, nobody can "spoof" your pages by going to "output.php?name=BuzzLY". $_POST['name'] won't be set to "BuzzLY", so your page will output "Hello, ".

HTH

AndrewPHP

This PHP script uses $_GET[] to get information from the URL. The PHP script is non-interactive and provides service to a remote program.