Here's why Register Globals can be a security risk. If you are a bad PHP programmer or you have installed PHP code that was written by a bad PHP programmer, their code might assume that a variable is starting with a null value. For example, if you were going to calculate someone's salary you might say:
$salary .= $amount_from_company;
$salary .= $amount_from_investments;
$salary .= $amount_from_collecting_cans_dug_from_trash_cans;
print "You made $salary last year";
The problem is that someone might call your page and pass in a value for salary like this:
http://www.yourdomain.com/script.php?salary=60000
And if you look at the sample code above, it assumes that $salary is starting at zero and adding the new figures.
People could pass in values that could cause your script to erase files from your web server or increase someone's salary. Imagine, for example, that a bad PHP programmer wrote a program called "Foo Accounting" and millions of customers started using that software. If someone discovered a flaw in that accounting software, then they could take advantage of the hole on every web site where the software was installed. All because Register Globals was turned on. Turning RG off forces the programmer to explicitly get the values from the Request String. If the programmer doesn't explicitly ask for the data, then the variable starts at zero.
