Register globals is a setting that takes the contents of several standard arrays of information and makes them into real variables.
It's possible to imitate this (if a little awkward) by doing it manually.
Loop through each of the arrays and create a new variable by that name. It's something like this:
PHP Code:
$arrays = array('_GET','_POST','_COOKIE');
foreach($arrays as $array) {
foreach($$array as $varname=>$varvalue) {
$$varname = $varvalue;
}
}
If you want to use this, put it at the very beginning of everything. That will simulate register globals, which runs before anything else.
I'm not recommending this necessarily. It IS a security risk. But if that's what the (bad) coding of the script you want to use requires, there's no easy way around it.
It's not necessarily just cookie, post and get. And I'm not sure what order they are supposed to go in. Technically there's an order for this so that if you have, for example, a variable with the same name in GET and POST, then one or the other will be stored second, causing the other to be over-written. You can look that up if it matters.
Secondly, this script may only require a certain subset of the above values. For example, maybe you only need POST.
Additionally, $_REQUEST includes all of those combined. So you could just use this:
PHP Code:
foreach($_REQUEST as $varname=>$varvalue) {
$$varname = $varvalue;
}
I'm not sure if there's any difference. Maybe that's better because it's simpler.
Finally, if you can track down the individual values it requires (the actual variables it uses) then you can "fix" the script by ONLY globalizing those values. It's safer than globalizing all of them.
Here's the reason for it not being safe:
Let's say you have a variable called "$admin" where a value of 1 means the user is an admin. If you have register globals on (or this fake version of it), then if the user submit a url ending with ?admin=1 then that value from the GET array will become the new value for the real variable $admin and bypass your security.
A well written script should still in theory be protected from this, but it's very easy to forget something.
Finally, another way to do this safely would be the following:
Create a local context within a function. Then "globalize" the variables there-- using the functions I gave above. They won't actually be global-- they'll be local, but they will be available as those names ($variable, rather than $_GET['variable']). That should work for your script. Just remember that you'll need to run your script within the function.
This will be a dummy function. It will look like this:
PHP Code:
function dummyfunction(){
//place ALL of your code here that is for THIS script.
//keep any security code, system configuration stuff, etc., outside the scope of this function (the normal way) and it will be safe from register globals interference
}
dummyfunction();
Help please it does not work..
Reply With Quote
Originally Posted by djr33
Bookmarks