PHP Day 10: Security Issues with Superglobals and register_globals
This six-minute video explores the security issues and differences between the superglobals $_GET, $_POST, and $_REQUEST, as well as the problematic register_globals option.
Links for PHP Day 10: Security Issues with Superglobals and register_globals
Security issues and differences between superglobals $_GET, $_POST, and $_REQUEST:
- PHP Get - Overview of the
$_GETsuperglobal array. - PHP Post - Overview of the
$_POSTsuperglobal array. - Essential PHP Security Chapter 2 - Forms and URLS (PDF file) - A free sample chapter from the book Essential PHP Security by Chris Shiflett. I didn’t understand all of it, but it has some great explanations and examples of several exploits.
About register_globals:
- Programming: PHP: Register Globals - A short overview of the problem with register_globals.
- PHP: Using Register Globals - More details from the security section of the PHP manual.
Turning off register_globals:
- Using a php.ini File - A good, basic overview.
- .htaccess Tutorial - General info on the .htaccess file.
- To turn off register_globals through the .htaccess file, just write “
php_flag register_globals off” in it.
Originally I planned to cover PHP security in one video, but then I ended up spending half my day yesterday just reading about PHP security issues! Needless to say, I’ll be revisiting this topic.
June 30th, 2008
This is a great tutorial. I love how all the main salient information in presented so concisely.
July 31st, 2008
Couldn’t get the htaccess link on your site to work.
July 13th, 2009
Your tutorials are great and really helped with the superglobal concept. I have one question. I created several scripts that insert and retrieve data from a mySQL database. In my php.ini file, when I have register_globals set to on everything works fine but, I would really like to turn them off. But, when I do, I cannot set or retrieve from my database. I know I need to use superglobals but could you give me an example of how I need to change my code. Here is an example of my code:
I sure could use your help. Thanks in advance