Will this cause the PHP global variable uninitialized vulnerability?

I want to write a blog for myself for my self-taught PHP. The current idea is that every file that can be displayed on the foreground must contain global. PHP file global. PHP file define (GLOBAL_PHP, true) each file that cannot be displayed (for example, under the include directory or func. php or other inc...

I want to write a blog for myself for my self-taught PHP.

The current idea is to include the global. php file for each file that can be displayed on the foreground.
Global. php file define (GLOBAL_PHP, true)
Each file that cannot be displayed (such as files in the include directory, func. php, or other inc)
There will be no definition of GLOBAL_PHP.
If this is not defined, the forbidden. php page is displayed.

Is the variable Initialization Vulnerability not caused by the use of _ GET?
It is inferred from the figure. It should not be caused if it is not used. But I'm not sure.

Two downstairs ..
A version can be specific ..
The other one .. I asked if the vulnerability could be caused, not to prevent access .. After all, there are other options, such as admin. php, that can be placed in the root directory. I will not put them in the root directory ..

Reply content:

I want to write a blog for myself for my self-taught PHP.

The current idea is to include the global. php file for each file that can be displayed on the foreground.
Global. php file define (GLOBAL_PHP, true)
Each file that cannot be displayed (such as files in the include directory, func. php, or other inc)
There will be no definition of GLOBAL_PHP.
If this is not defined, the forbidden. php page is displayed.

Is the variable Initialization Vulnerability not caused by the use of _ GET?
It is inferred from the figure. It should not be caused if it is not used. But I'm not sure.

Two downstairs ..
A version can be specific ..
The other one .. I asked if the vulnerability could be caused, not to prevent access .. After all, there are other options, such as admin. php, that can be placed in the root directory. I will not put them in the root directory ..

Let me answer this question myself.

Reference 1:
PHP Security Guide address:
Http://phpsec.org/projects/guide/1.html
A book on PHP security.

Reference 2:
Http://php.net/manual/en/security.globals.php
PHP4.2 release announcement

This statement:
Perhaps the most controversial change in PHP is when the default value for the PHP directive register_globals went from ON to OFF in PHP» 4.2.0. reliance on this directive was quite common and need people didn't even know it existed and assumed it's just how PHP works. this page will explain how one can write insecure code with this directive but keep in mind that the directive itself isn't insecure but rather it's the misuse of it.

That is to say,PHP4.1 and earlier versionsPHP installed by default,
If no variable is defined, it will give you the equivalent of using _ GET ["variable"] To GET the value of the variable.
Example:

《? Php
Global $ user;

If $ user = "admin "{
Admin ();
}
Else {
User ();
}

?

That is to say, you only need test. php & user = admin to access this page, and you will have administrative permissions directly.

To avoid this vulnerability, modify the php configuration file register_globals to OFF.

PHP4.2 and later versions won't.

Grep-r register_globals/etc/php *

Check the version. 5.5 pass ......

To prevent php files from being accessed, only index. php is placed under document root as the single portal. Other php files should not be placed under document root.