as someone said, you\'re problably using php 4.20. i advise you not to turn register_globals on. instead you should use at the beginnning of your page :
$PHP_SELF = $_SERVER[\"PHP_SELF\"];
i\'d never thought of the effects if someone had called my script by \"script.php?PHP_SELF=http://www.hacked.com\"
something like that. don\'t know if it would have worked, but now with php 4.20 and register globals off, it\'s impossible.