Open a dialog about a discussion which relaxes PHP's security badly? Of course it IS the developers fault who are NOT aware of the implications when using register_globals on. There is nothing else the PHP Team can to then make serious default setting of those developers are not able to understand what they are doing.

And for you, it's changing one line in the INIs so what?

If it's your ISP who decides to let this be disabled by default that it's a good ISP. If that's what you complain about, complain at your ISP (who, honestly, should not relax this feature).

As of PHP 4.1.0 there is this function:

http://www.php.net/manual/en/function.import-request-variables.php

I think maybe one of us is missing the point (and it's probably me!).  php.ini-recommended says:
"Note that register_globals is going to be depracated (sic)(i.e., turned off by default) in the next version of PHP, because it often leads to security bugs."
I take this to mean that register_globals will off permanently and cannot be turned back on, even in the INI.
But if it means that it will default to OFF but can still be turned ON in the INI, then I have no complaint.  This would protect the novice but allow those who understand the implications to turn it on.  Although the latter doesn't sound to be any more than how the distribution INIs are written.
My issue is not the wisdom of having it ON or OFF, just the wisdom of taking away the option of choosing from the PHP system administrator.
Avaliability of functions like that suggested by sniper are fine, but would still take a huge effort to change all the code and the potential is high for breaking any part of it by missing one place to add the function.
You comments and thoughts are appreciated.
Colin

See also: import_request_variables() and extract() for ways to deal with this issue.

In PHP, deprecated means "Maybe one day it won't work but not sure if/when that'll be exactly, here's why you shouldn't use this..."  I assume register_globals will work for awhile, and nobody knows when (or if) it won't (yet).

So the question is "When will register_globals not work?"  A good question indeed.  Not a documentation problem as nobody has the answer, yet.

Philip,
Thanks for the PHP definition of "deprecated".  The American Heritage Dictionary defines it as "To expressly disapprove of; protest or plead against - from the latin deprecari  - to ward off by prayer". (I like the latin definition <grin>.)
I think the usage in software circles is generally taken to mean "this is going away sometime in the future".
In any definition, I reinterate my original statement that I lobby for it never going away, just defaulting to NO with the option to set to YES in the INI (effectively as the php.ini-recommended has it now.)
Colin

I'm going to assume that register_globals will forever be an available PHP directive (I hope so).  Especially after seeing the impact changing the default to off has made.  Is there an official word on this?

Btw, I like the latin definition too :)

Btw, profound observations of the meaning of depreciated are best left to private mail.