php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #15108 Server variables to exist globally w/ register_globals = off
Submitted: 2002-01-18 16:14 UTC Modified: 2002-03-15 09:54 UTC
From: philip at cornado dot com Assigned:
Status: Closed Package: Feature/Change Request
PHP Version: 4.2.0 OS: n/a
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: philip at cornado dot com
New email:
PHP Version: OS:

 

 [2002-01-18 16:14 UTC] philip at cornado dot com 
In short, when register_globals = off, server variables would/should continue to register globally.  Variables such as:

  $PHP_SELF, $DOCUMENT_ROOT, $REMOTE_ADDR, etc.

As currently they do not.  And on a sidenote, the current docs imply that server variables always exist, regardless of setting.  Some possible options:

a) Create a new config setting, such as register_server_globals or register_predefined_globals
b) Make register_globals allow for individual EGPCS settings (default to S)
c) Make server variables always exist, like track_vars do now.
d) ...

This will help ease the register_globals = off transition as well as cause a lot less "4.2.0 BROKE PHP!!!" emails.  But most importantly, this will be useful.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-01-18 16:52 UTC] hholzgra@php.net 
> But most importantly, this will be useful.

no it won't, same security consideration as with
the other global registrations
 [2002-01-18 23:47 UTC] philip@php.net 
After some searching, came across an important thread that my brain never saw.  The proposal on the issue of register_globals and "the big change":

  http://marc.theaimsgroup.com/?l=php-dev&m=99638397319055

Which includes some great information.  Including import_globals(), which in short, my concern is solved by: import_globals('S').  This next thread (very long) is very related too, which existed before the above proposal:

  http://marc.theaimsgroup.com/?l=php-dev&m=99600275103594

It's all sounds good.  

But :)  Throughout the history of the manual, it's been *implied* that predefined server variables are registered globally.  This will obviously change (see #14472) but point is, this is a potential problem.  Is this worth doing anything else about?  Like, defaulting PHP with 'S' (or ES) for a release or two?  Or, would that just add unneeded confusion.
 [2002-03-15 00:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a month, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 [2002-03-15 09:54 UTC] sniper@php.net 
this won't be changed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Jul 03 22:01:33 2025 UTC