Problems after reinstalling PHP

phpbuild-it

Hi All,

Having reinstalled PHP from 4.01 to 4.3.4, I am having problems with:

1) setting register_globals to "On"
2) setting the value of a session variable passed thru from the url.

FYI, this is based on the windows version running Apache.

I need register_globals = "On" because of my previou scripts. When it's set, this is clearly not indicated when displaying phpinfo(), but looking in my php.ini I have definately set it. I have checked everything, from the path of php.ini to converting php to the older version.

However, when I switch the PHP installation to CGI, it works! Is this the only option?

register_globals = "On". This problem is more of a concern as I can not find an easy solution. Imagine you have two scripts.

Scenario 1

//Script 1:

//registers a session variable and set it with a value.

session_register("v");
$v = 12;

//Then it links off to script 2
<a href="script2.html>"Go to script 2</a>

//Script 2:

//Displays the variable. No problem.
echo "$v";

Scenario 2

//Script 1:

//register a session variable but no value is set.

session_register("v")

//Then it links off to script 2, setting $v at this point
<a href="script2.html?v=12>"Go to script 2</a>

//Script 2:

//Displays the variable. Problems.
echo "$v";

I understand the variable is in $_GET, but having set register_globals = "On" I thought this can be avoided. Before my new installation, both scenarios displayed the variable without difficulty.

I hope someone can help, and what feedback I get will tell me the latest PHP installation is more flexible.

Thanks in advance

phpbuild-it

AstroTeg

Global variables are rather evil. So evil that at some point along PHP v4.2.x (I think) they made it so you had to use $GET/$POST instead of just the form variable name. Same goes for the session data.

The reasoning was a 'net thug could (from the URL) reassign variable values and the PHP script had no clue. I believe it was also possible for a thug to change values of other variables that were not meant to be changed (assuming they knew the variable name - but with open source software, they could download the code and find out).

phpbuild-it

Thanks for your reply. I understand, future installments of PHP, global variables will be terminated. But how can / could you explain what is happening?

Using the scenario

Scenario 3

//Script 1:

//NO session variable set.
//session_register("v")

//Then it links off to script 2, setting $v at this point
<a href="script2.html?v=12>"Go to script 2</a>

//Script 2:

//Displays the variable. No Problem. Your not forced to use $_GET.

echo "$v";

You are only forced to use $_GET when the variable is registered as a session. Is this part of a new security prevention? Session variables can not be overwritten from the "get" variables even when register_globals is switched "On".

Thanks

AstroTeg

If it was me, I'd just write out $GET, $POST, and $_SESSION.

Here's what the folks at php.net have to say about [man]session_register[/man]

"CAUTION: If you want your script to work regardless of register_globals, you need to instead use the $SESSION array as $SESSION entries are automatically registered. If your script uses session_register(), it will not work in environments where the PHP directive register_globals is disabled."

Good idea to keep register globals off:

"register_globals: important note: Since PHP 4.2.0, the default value for the PHP directive register_globals is off. The PHP community encourages all to not rely on this directive but instead use other means, such as the superglobals."

And one more caution:

"CAUTION: If you are using $_SESSION (or $HTTP_SESSION_VARS), do not use session_register(), session_is_registered(), and session_unregister()."