[Resolved] About register_globals..

[plasmahba]

Hello

I was reading something that refers that is recommended to turn off the register_globals due security matters. ( I´m not exactly sure what does "security matters mean" yet)

Anyway, I found out that I have those register_globals "on" and suddenly my sessions and php stop working ¡?¡?

Is there a particular reason why this might be happening?

Is there something I should consider or change?

Any help is full apreciated

Thanxs

[drawmack]

without code I can't help with your problems however I can explain the security reasons.

With register globals on you can access data like this:
Form field named mydata is accessed in php with $mydata, session variable named mydata is accessed in php with $mydata.

However which variable overwrites which? I don't know but it could be possible for someone to spoof session variables by placing the information in the url. i.e. www.mysite.com?userid=jack then in the program you access $userid and you're getting my get variable even though I don't have a session on your server.

Without register globals turned on then the get variable would be $GET['userid'] and the session variable would be $SESSION['userid'] so I can't spoof the system so easily anymore.

[plasmahba]

Thanx for your input!

This is the code that is not working since I turn the globals off
Is my validate sesion php

$rs = mysql_query($ssql,$Conn) or die(mysql_error());

if (mysql_num_rows($rs)!=0){

session_start(); 
$_SESSION["autent"] = "YES"; 

$arrRecord = mysql_fetch_array($rs); 

if ($arrRecord['Range'] == "1")

header("location: users.php");

else

header("location: admin.php");

}else {

header("Location: login.php?erroruser=yes");

________________________________________-
Sesion.php

<?

session_start();

if ($_SESSION["autent"] != "YES") {

header("Location: login.php"); 

exit(); 

}
?>

Probably you may see something to change

Thanx

[tsinka]

Hi,

make sure that you add a exit after each header call (in the first script, too, since I can't see the exit).

Additionally you might try to put session_write_close() in front of the header calls.

Without the exit it might happen that the second page loads before the first script terminates thus loading the second page before the session data has been written.

Do you use session_register instead of $_SESSION anywhere in your code ?

Thomas

[Tea_J]

just a quick note.. if registered globals are off, you have to declare the variables being past.. post or get... or else it wont exist in your script

eg:

if you pass the variable name=tea and try to use it in the script as

echo $tea;

that wont work if RegGlobals is off. you have to use $POST or $GET
.. if the var passed is get, use it this way:

echo $_GET['name'];

just a reminder.

tea

[Roger_Ramjet]

See this article for an explanation of the reasons for having 'register globals' OFF

http://www.sitepoint.com/print/write-secure-scripts-php-4-2

And a very good example of how to write or rewrite scripts for the new environment.