杂类问题

doerr at apkk dot de (2010-12-28 17:41:57)

If you only needed register_globals for get/post variables, the effictive solution for 5.3 is:
import_request_variables("GPC", "");
But if the skripts relied on session_register() you'll have to do more:
- Replace all variables that appeared after session_register with _SESSION equivalents - so $myvar becomes $_SESSION['myvar']
- Take care if your variables appeared inside strings - 'Hello $user !' works, but 'Hello $_SESSION['user'] !' not - so you have to concatenate the string: 'Hello '.$_SESSION['user'] .' !'
- Session variables in function declarations (for whatever purpose) will not work - keeping the old (local) names will work in most cases.
- Finally, replace the session_register(..) line with session_start()

(2005-07-19 09:08:26)

using .htaccess file to disable register globals (register_globals)
The syntax for setting an option is:
php_value name value
php_flag name on or off
Example:
php_flag register_globals off
php_value arg_separator.output &
The example turns off register_globals and sets the value of arg_separator.output to & which is preferred rather than the default &.
Note: you can also set boolean options with the php_value directive, the string will be converted to boolean before assignment.
you can also use .htaccess to turn magic quotes on or off.
Search php.net and you'll find it

markus (2005-06-18 15:34:33)

Considering the comment below. I think there's a way to avoid that "problem":

<?php
//
// $starttime is an example of a variable that we might need to define,
// even before, running the "register_globals OFF" emulator below.
//
list($msec, $sec) = explode(' ', microtime());
$starttime = ((float)$msec + (float)$sec);

//
// If register_globals is ON, ensure no unexpected globals are defined.
// ie. We'll try to emulate a register_globals OFF environment.
//
if( (bool)@ini_get('register_globals') )
{
    $superglobals = array($_ENV, $_GET, $_POST, $_COOKIE, $_FILES, $_SERVER);
    if( isset($_SESSION) )
    {
        array_unshift($superglobals, $_SESSION);
    }
    $knownglobals = array(
        //
        // Known PHP Reserved globals and superglobals:
        //
        '_ENV',        'HTTP_ENV_VARS',
        '_GET',        'HTTP_GET_VARS',
        '_POST',    'HTTP_POST_VARS',
        '_COOKIE',    'HTTP_COOKIE_VARS',
        '_FILES',    'HTTP_FILES_VARS',
        '_SERVER',    'HTTP_SERVER_VARS',
        '_SESSION',    'HTTP_SESSION_VARS',
        '_REQUEST',

        //
        // Global variables used by this code snippet:
        //
        'superglobals',
        'knownglobals',
        'superglobal',
        'global',
        'void',

        //
        // Known global variables defined before this code snippet is reached.
        //
        'starttime',
    );
    foreach( $superglobals as $superglobal )
    {
        foreach( $superglobal as $global => $void )
        {
            if( !in_array($global, $knownglobals) )
            {
                unset($GLOBALS[$global]);
            }
        }
    }
}
?>

Note the stuff related to the $_SESSION array depends on whether the PHP session has been started or not. You might want to call session_start() before this point (or set session.auto_start ON).

HTH+ :)

php at REMOVEMEkennel17 dot co dot uk (2005-04-12 20:22:42)

Regarding simulating register_globals = off, note that it is impossible to adequately prevent $_SESSION variables from being globalised, as the array (and thus the globals) are created on a call to session_start(). You would therefore have to 'undo' this when you start a session as using it at the start of your script will have no effect.
To avoid potential problems, use a prefix that is unique for all session variables (e.g. 'SESS_'), and only access them via the $_SESSION array. The prefix ensures that you don't have a naming clash (and therefore a security risk) with any non-session globals.