[RESOLVED] How do I turn Register Globals Off

conjurer

I have access to PHP5 through my webhost, but it shows in the phpinfo() listing that register globals is on.

It says configuration file is in

Configuration File (php.ini) Path /usr/local/php5/lib/php.ini
Scan this dir for additional .ini files _custom_php_settings

I don't seem to get access to /user/local/php5/lib/

Can I put something somewhere else to shut this off?

NogDog

If it's an Apache web host, create or modify and existing .htacess file in your root web directory with this line:

php_flag register_globals off

conjurer

I have that in there and it is working on the PHP4 version, but on 5 it is not shutting it down.

PHP5 seems to be running as a cgi

:glare:

bradgrafelman

If it's CGI, then you're not going to have much luck changing this (as you've found).

I seem to remember someone having some PHP code that essentially reversed the effects of register_globals...

EDIT: Couldn't find it easily, so try creating a function such as:

function undo_register_globals() {

$lookin = array($_POST, $_GET, $_COOKIE, $_SERVER);
if(isset($_SESSION)) {

	$lookin[] = $_SESSION;

}

foreach($lookin as $array) {

    foreach($array as $key => $value) {

        unset($GLOBALS[$key]);

    }

}

}

and calling it at the very beginning of your PHP scripts.

conjurer

My host sorted this out for me:

you should create a directory 'custom_php_settings' in the dir where your PHP5 script is running. Then you can put any *.ini file within the 'custom_php_settings' dir, this .ini file should have exactly the same syntax as php.ini config. Thus you can override default PHP5 settings.