Php has no security vulnerabilities.

If your php. register_globalsOn in ini, all post, get, cookie, and session variables with the same name will be mixed together. you can use $ HTTP _ * _ VARS [username] to determine the variable you want. however, even if the name is the same. in ini, variables_orderGPCS will also be determined based on the priority level. low-level values cannot be used if your php. in ini, register_globals = On, all post, get, cookie, and session variables with the same name will be mixed together,
You can use $ HTTP _ * _ VARS ["username"] to determine the variable you want.
However, even if the name is the same, in php. ini, variables_order = "GPCS" is determined based on the priority level, and the low-level value cannot overwrite the higher-level value.
Therefore, it is wise to use session_register ("username") at the beginning. you can also use session_is_registered to determine whether the variable has been registered.
This is an example:
If (! Session_is_registered ("username ")){
$ User_name = "";
Session_register ("username ");
}
At the same time, make sure that in your php. ini, variables_order = "GPCS" (default) S indicates that the session should be placed at the end, with priority.
Register_globals = On is a waste of system resources and is disabled in the optimization configuration. This avoids the so-called vulnerability.

Because I have encountered this problem before, please refer to it for your reference.