Why is REGISTER_GLOBALS so bad?

by

REGISTER_GLOBALS means that all variables passed through GET or POST are avilable as global variables in your script. Since accessing undeclared variables is not an error in PHP (it’s a warning), it can lead to very nasty situations. Consider this, for example:

<?php
// $debug = true;
if ($debug) {
    echo "query: $query\n";
}

It is not a bad thing per se (well engineered code should not generate warnings, therefore should not access any variables that might be undeclared (and should not need REGISTER_GLOBALS for the same reason)), but PHP code is usually [very] low quality, leading to this kind of security holes.

More Related Contents:

  1. when upload zip folder validate that only .jpg,.png files will save inside zip folder +php [closed]
  2. Search engine PHP return error [closed]
  3. how to read Json values [closed]
  4. Use global variables in a class
  5. difference between two arrays
  6. How to debug in WooCommerce 3+
  7. How do I convert a string to a number in PHP?
  8. How can I write SQL for a table that shares the same name as a protected keyword in MySql? [duplicate]
  9. Detect language from string in PHP
  10. Does PHP have short-circuit evaluation?
  11. Truncate text containing HTML, ignoring tags
  12. Change Timezone in Lumen or Laravel 5
  13. scandir() to sort by date modified
  14. Print the keys of an array
  15. How to resolve “must be an instance of string, string given” prior to PHP 7?
  16. How to get previous month and year relative to today, using strtotime and date?
  17. jQuery Ajax returns the whole page
  18. How to check if an uploaded file is an image without mime type?
  19. Get characters after last / in url
  20. Pass data from jQuery to PHP for an ajax post
  21. Using MX records to validate email addresses
  22. What’s difference between __construct and function with same name as class has? [duplicate]
  23. Explode string by one or more spaces or tabs
  24. Warning: mysqli_query() expects parameter 1 to be mysqli, resource given [duplicate]
  25. How to Make Laravel Eloquent “IN” Query?
  26. Laravel Eloquent ORM Transactions
  27. Can PHP’s glob() be made to find files in a case insensitive manner?
  28. Parse math operations with PHP
  29. Array size limit in PHP
  30. PHP – GetSQLValueString function

Leave a Comment