php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #15108 Server variables to exist globally w/ register_globals = off
Submitted: 2002-01-18 16:14 UTC Modified: 2002-03-15 09:54 UTC
From: philip at cornado dot com Assigned:
Status: Closed Package: Feature/Change Request
PHP Version: 4.2.0 OS: n/a
Private report: No CVE-ID: None
View Developer Edit
 [2002-01-18 16:14 UTC] philip at cornado dot com 
In short, when register_globals = off, server variables would/should continue to register globally.  Variables such as:

  $PHP_SELF, $DOCUMENT_ROOT, $REMOTE_ADDR, etc.

As currently they do not.  And on a sidenote, the current docs imply that server variables always exist, regardless of setting.  Some possible options:

a) Create a new config setting, such as register_server_globals or register_predefined_globals
b) Make register_globals allow for individual EGPCS settings (default to S)
c) Make server variables always exist, like track_vars do now.
d) ...

This will help ease the register_globals = off transition as well as cause a lot less "4.2.0 BROKE PHP!!!" emails.  But most importantly, this will be useful.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-01-18 16:52 UTC] hholzgra@php.net 
> But most importantly, this will be useful.

no it won't, same security consideration as with
the other global registrations
 [2002-01-18 23:47 UTC] philip@php.net 
After some searching, came across an important thread that my brain never saw.  The proposal on the issue of register_globals and "the big change":

  http://marc.theaimsgroup.com/?l=php-dev&m=99638397319055

Which includes some great information.  Including import_globals(), which in short, my concern is solved by: import_globals('S').  This next thread (very long) is very related too, which existed before the above proposal:

  http://marc.theaimsgroup.com/?l=php-dev&m=99600275103594

It's all sounds good.  

But :)  Throughout the history of the manual, it's been *implied* that predefined server variables are registered globally.  This will obviously change (see #14472) but point is, this is a potential problem.  Is this worth doing anything else about?  Like, defaulting PHP with 'S' (or ES) for a release or two?  Or, would that just add unneeded confusion.
 [2002-03-15 00:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2002-03-15 09:54 UTC] sniper@php.net 
this won't be changed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Jul 03 16:01:36 2025 UTC