register_globals is really only potentially dangerous if you use uninitialized variables in certain ways. For instance, suppose you do the following in your code:
$array['name'] = 'NogDog';
$array['age'] = 'old';
foreach($array as $key => $val)
{
echo "<p>$key: $val</p>\n";
}
Now suppose a malicious user submitted his own form that called your page as the action, including the following input field:
<input type='text' name='array[]' value='<script type="text/javascript">malicious code here</script>'>
If register_globals is on, then the above script's foreach loop will now output the malicious script as well as the intended text. However, if you had initialized the $array before assigning values, this would not be an issue:
$array = array();
$array['name'] = 'NogDog';
$array['age'] = 'old';
foreach($array as $key => $val)
{
echo "<p>$key: $val</p>\n";
}
Similar things could happen with uninitialized scalar variables, but again only if used in certain ways, such as using the ".=" operator to append values to a string variable without first setting it to a value (or empty string) via the "=" operator.
So, if you are careful not to use uninitialized variables and always get your external inputs from the applicable array ($POST, $GET, etc.), your script should run fine regardless of whether or not register_globals is on.
