'register_globals=off'

ed210

Hello, I am a complete noob when it comes to programming of any sort. I have been using a script for a simple addressbook that I found here:

http://webmonkey.wired.com/webmonkey/99/21/index3a_page6.html?tw=programming

However, I read on http://www.php.net/release_4_1_0.php that 'PHP setups which rely on register_globals being on (i.e., on form, server and environment variables becoming a part of the global namespace, automatically) are very often exploitable to various degrees'. Do you think this is this a big problem with the addressbook script?

Does anybody no how to adapt this script to work if 'register_globals=off'?

Thank you in advance!

LordShryku

It could be a problem. Someone could technically delete records by passing a few variables in the URL. If you wanted to convert it (and that would be a good idea), you should look at the manual's description of register_globals. You'll need to change incoming variables into the array elements of where they are expected (POST, GET, SESSION, COOKIE). So if the form is setup as method="post", you do something like this:

if($id) {
# would be
if(isset($_POST['id'])) {

The isset part essentially does the same check as the first one, just making sure the variable is set. Using [man]isset[/man] or [man]empty[/man] to check is the right way to do it though. Since the form is a method of post, you changed $id, to $_POST['id'].

Good luck 🙂

ed210

I have not tested this yet but I think this may work...

<html>
<body>
<?php

$db = mysql_connect("localhost", "root");

mysql_select_db("mydb",$db);

if (!empty($_REQUEST['id'])) $id = $_REQUEST['id'];

if(isset($_REQUEST['submit'])) {

  // here if no ID then adding else we're editing

  if ($id) {

$first = $_REQUEST['first'];
$last = $_REQUEST['last'];
$address = $_REQUEST['address'];
$position = $_REQUEST['position'];

$sql = "UPDATE employees SET first='$first',last='$last',address='$address', position='$position' WHERE id=$id";

  } else {

$first = $_REQUEST['first'];
$last = $_REQUEST['last'];
$address = $_REQUEST['address'];
$position = $_REQUEST['position'];

$sql = "INSERT INTO employees (first,last,address,position) VALUES ('$first','$last','$address','$position')";

  }

  // run SQL against the DB

  $result = mysql_query($sql);

  echo "Record updated/edited!<p>";

} elseif (isset($_REQUEST['delete'])) {

// delete a record

$sql = "DELETE FROM employees WHERE id=$id";	

$result = mysql_query($sql);

echo "$sql Record deleted!<p>";

} else {

  // this part happens if we don't press submit

  if (!isset($_REQUEST['id'])) {

// print the list if there is not editing

$result = mysql_query("SELECT * FROM employees",$db);

while ($myrow = mysql_fetch_array($result)) {

  printf("<a href=\"%s?id=%s\">%s %s</a> \n", $PHP_SELF, $myrow["id"], $myrow["first"], $myrow["last"]);

  printf("<a href=\"%s?id=%s&delete=yes\">(DELETE)</a><br>", $PHP_SELF, $myrow["id"]);

}

  }

  ?>

  <P>

  <a href="<?php echo $PHP_SELF?>">ADD A RECORD</a>

  <P>

  <form method="post" action="<?php echo $PHP_SELF?>">

  <?php

  if (isset($_REQUEST['id'])) {

// editing so select a record

$sql = "SELECT * FROM employees WHERE id=$id";

$result = mysql_query($sql);

$myrow = mysql_fetch_array($result);

$id = $myrow["id"];

$first = $myrow["first"];

$last = $myrow["last"];

$address = $myrow["address"];

$position = $myrow["position"];

// print the id for editing

?>

<input type=hidden name="id" value="<?php echo $id ?>">

<?php

  }

  ?>

  First name:<input type="Text" name="first" value="<?php echo $first ?>"><br>

  Last name:<input type="Text" name="last" value="<?php echo $last ?>"><br>

  Address:<input type="Text" name="address" value="<?php echo $address ?>"><br>

  Position:<input type="Text" name="position" value="<?php echo $position ?>"><br>

  <input type="Submit" name="submit" value="Enter information">

  </form>

<?php

}

?>

</body>
</html>

Fingers crossed!