Php global variable vulnerability analysis-php Tutorial

Php global variable vulnerability analysis

If (isset ($ _ REQUEST ['globals']) OR isset ($ _ FILES ['globals']) { Exit ('request tainting attempted .'); } Register_globals is a control option in php. it can be set to off or on. The default value is off. it determines whether to register EGPCS (Environment, GET, POST, Cookie, Server) variables as global variables. If register_globals is enabled, the data submitted by the client contains the GLOBALS variable name, which overwrites the $ GLOBALS variable on the server. Therefore, this code determines that if the submitted data contains the GLOBALS variable name, the program will be terminated. The security problem caused by this becomes an "automatic global variable vulnerability" in PHP. Please disable the register_globals option. Use $ _ GET, $ _ POST, $ _ COOKIE instead of $ _ REQUEST. Discuz! The forum bypasses global variables to defend against vulnerabilities In php5.3.x php. ini, the default request_order value is GP, causing Discuz! In 6.x/7.x, global variable protection can be bypassed. In include/global. func. php: Function daddslashes ($ string, $ force = 0 ){ ! Defined ('Magic _ QUOTES_GPC ') & define ('Magic _ QUOTES_GPC', get_magic_quotes_gpc ()); If (! MAGIC_QUOTES_GPC | $ force ){ If (is_array ($ string )){ Foreach ($ string as $ key => $ val ){ $ String [$ key] = daddslashes ($ val, $ force ); } } Else { $ String = addslashes ($ string ); } } Return $ string; } Include/common. inc. php: Foreach (array ('_ cookies',' _ post', '_ get') as $ _ request ){ Foreach ($ _ request as $ _ key => $ _ value ){ $ _ Key {0 }! = '_' & $ _ Key = daddslashes ($ _ value ); } } When register_globals = on, you can bypass the above code by submitting the GLOBALS variable. Discuz! Provides the following defense methods: If (isset ($ _ REQUEST ['globals']) OR isset ($ _ FILES ['globals']) { Exit ('request tainting attempted .'); } $ _ REQUEST: the value of the Super global variable is determined by php. the effect of request_order in ini. in the latest php5.3, the default value of request_order is GP, that is, $ _ REQUEST contains only $ _ GET and $ _ POST, but not $ _ COOKIE by default. Use cookies to submit GLOBALS variables. Temporary solution: change php. ini settings in php 5.3.x and set request_order to GPC. We will introduce the global variable vulnerability and temporary solutions in php. I hope this will be helpful to you.