Hi -

register_globals is not necessarily a bad thing. Yes, a more object-oriented
approach is sometimes better, but sometimes a bunch of global variables are
the easiest way to get the job done.  As long as you know your variables and
understand any scoping implications, you will be fine.

If you would like to make a quick include you can put in the head of each of
your scripts to make your GET and POST vars global, even once
register_globals is removed from PHP, you could do something like this:





	if(isset($HTTP_GET_VARS)) {
		while(list ($key,$value) = each ($HTTP_GET_VARS)) {
			$GLOBALS[$key] = $value;
		}
	}



	if(isset($HTTP_POST_VARS)) {
		while(list ($key,$value) = each ($HTTP_POST_VARS)) {
			$GLOBALS[$key] = $value;
		}
	}





If you don't want to take that route, a good text editor like EditPlus or
some other editor with regular expressions can save you a ton of time.  Just
open each file and do a search for something like \$([a-zA-Z0-9\_]+) and
replace with something like $HTTP_GET_VARS[$\1]


Good luck!
Micah R. Condon



-----Original Message-----
From: owner-hwg-languages(at)hwg.org [mailto:owner-hwg-languages(at)hwg.org]On
Behalf Of David Mintz
Sent: Wednesday, March 06, 2002 9:46 AM
To: hwg-languages(at)hwg.org
Subject: register_globals (was Re: PHP Security Hole)


This is kind of a topic modulation from the original
thread but it's on the general topic.

I recently (read belatedly) discovered that
register_globals is destined to become ever more
strongly deprecated, then eliminated from PHP.
(Footnote to the uninitiated:  when register_globals
is set to "on" in PHP's configuration, a variable
named "foo"  coming in as either GET, POST or a cookie
is automatically available simply as $foo)

I'm certain this too is a Good Thing over the long
term. In the short term, it's brutal. I wrote a number
of naive PHP scripts, now in production, that rely on
register_globals (largely guided by PHP tutorials that
presented this feature as though it was the coolest
thing). Now I have to start fixing these scripts one
by one. True, if it comes to that, you can keep using
your earlier PHP version while the rest of the world
moves on, but I don't think that's the best option.

I wonder if anyone has any ideas about strategies. My
thought is, copy your PHP files to your local machine
where PHP has register_globals turned off, and hack
hack hack until they work. Gradually patterns should
emerge and the migration should pick up speed, I hope.

Thanks,

David Mintz
Spanish Interpreter
US District Court, Southern District of New York
Web Design & Hosting http://www.dmintzweb.com/
Personal http://www.panix.com/~dmintz/

"You want me to pour the beer, Frank?

__________________________________________________
Do You Yahoo!?
Try FREE Yahoo! Mail - the world's greatest free email!
http://mail.yahoo.com/

HWG: hwg-languages mailing list archives, maintained by Webmasters @ IWA