Php security hazards caused by setting registerglobals to TRUE

Many people have seen the danger of setting registerglobals to TRUE. but how can this problem be solved? A lot of new users should not know! So let me briefly talk about the dangers of setting registerglobals to on!

Many people have seen the danger of setting register globals to TRUE. but how can this problem be solved? A lot of new users should not know! So let me briefly talk about the dangers of setting register globals to on!

Let's take a look at the following code:The following code is available in the config. php file:

2. $ GLOBALS ['host'] = 'localhost ';
3. $ GLOBALS ['username'] = 'root ';
4. $ GLOBALS ['password'] = '';
5. $ GLOBALS ['database'] = 'test ';
6. ?>

The following code is available in db. php:

2. Require_once 'config. php ';
3. Function db_connect (){
4. $ Db = mysql_connect ($ GLOBALS ['host'], $ GLOBALS ['username'], $ GLOBALS ['password']);
5. Mysql_select_db ($ GLOBALS ['database'], $ db );
6. Return $ db;
7. }
8. ?>

Obviously, the above code is added when register globals is set to on to see what the effect is:

In the browser, enter http: // ********/index. php? GLOBALS = *** then the code above will be executed incorrectly! Because $ GLOBALS data has been modified! When register globals is set to on ,? GLOBALS = *** is converted to $ GLOBALS = !! So it is very dangerous.

Although this example is not harmful, we should check whether register GLOBALS is set to on in some places where the $ globals global variable is needed. you can use the following code to check whether the register GLOBALS is set to on.

1. Function wp_unregister_GLOBALS (){
2. If (! Ini_get ('register _ globals '))
3. Return;
4. If (isset ($ _ REQUEST ['globals'])
5. Die ('globals overwrite attempt detected ');
6. // Variables that shouldn't be unset
7. $ NoUnset = array ('globals', '_ get',' _ post', '_ cookies',' _ request', '_ server',' _ env ', '_ Files ');
8. $ Input = array_merge ($ _ GET, $ _ POST, $ _ COOKIE, $ _ SERVER, $ _ ENV, $ _ FILES, isset ($ _ SESSION) & is_array ($ _ SESSION )? $ _ SESSION: array ());
9. Foreach ($ input as $ k => $ v)
10. If (! In_array ($ k, $ noUnset) & isset ($ GLOBALS [$ k]) {
11. $ GLOBALS [$ k] = NULL;
12. Unset ($ GLOBALS [$ k]);
13. }
14. }