Php security hazards caused by setting register globals to TRUE

Problem
Dangers of setting register globals to TRUE
Solution
Dangers of setting register globals to TRUE
Many people have seen it very dangerous to set register globals to on. But how can this problem be solved ?? A lot of new users should not know! So let me briefly talk about the dangers of setting register globals to on!
Let's take a look at the following code:
The following code is available in the config. php file:

$ GLOBALS ['host'] = 'localhost ';

$ GLOBALS ['username'] = 'root ';

$ GLOBALS ['Password'] = '';

$ GLOBALS ['database'] = 'test ';

?>


The copy Code contains the following code in db. php:

Require_once 'config. php ';

Function db_connect (){

$ Db = mysql_connect ($ GLOBALS ['host'], $ GLOBALS ['username'], $ GLOBALS ['Password']);

Mysql_select_db ($ GLOBALS ['database'], $ db );

Return $ db;

}

?>


Copy the code. It is obvious that the above Code is added when register globals is set to on to see what the effect is:
In the browser, enter http: // ********/index. php? GLOBALS = *** then the code above will be executed incorrectly! Because $ GLOBALS data has been modified! When register globals is set to on ,? GLOBALS = *** is converted to $ GLOBALS = !! So it is very dangerous.
Although this example is not harmful, we should check whether register GLOBALS is set to on in some places where the $ globals global variable is needed, run the following code (the code is from wordpress): function wp_unregister_GLOBALS (){

If (! Ini_get ('register _ globals '))

Return;



If (isset ($ _ REQUEST ['globals'])

Die ('globals overwrite attempt detected ');



// Variables that shouldn't be unset

$ NoUnset = array ('globals', '_ get',' _ Post', '_ cookies',' _ request', '_ Server',' _ env ', '_ files ');



$ Input = array_merge ($ _ GET, $ _ POST, $ _ COOKIE, $ _ SERVER, $ _ ENV, $ _ FILES, isset ($ _ SESSION) & is_array ($ _ SESSION )? $ _ SESSION: array ());

Foreach ($ input as $ k => $ v)

If (! In_array ($ k, $ noUnset) & isset ($ GLOBALS [$ k]) {

$ GLOBALS [$ k] = NULL;

Unset ($ GLOBALS [$ k]);

}

}


Copy the code!

[]


Reference answer
Well, I like this kind of detailed articles!