Register_Globals?

[peter]

Hi. I am just learning PHP. I'm taking over the website at work,
which is coded in PHP. I am wondering about register_globals. They are
on on the server we use. Is that a threat? I understand I may have to
recode if I turn them off, but is there a simple way to turn them off
and see if the code still works?
Thanks,

Peter

[Andy Hassall]

On 9 Sep 2005 14:54:20 -0700, "peter" <pl*****@yahoo.com> wrote:

Hi. I am just learning PHP. I'm taking over the website at work,
which is coded in PHP. I am wondering about register_globals. They are
on on the server we use. Is that a threat?
Not directly, as it is quite possible to write safe code with register_globals
turned on, although it's bad practice. However, with register_globals enabled,
certain sorts of poor programming practices can be made unexpectedly much
worse, by the automatic creation of global variables. In particular, code that
relies on variables being undefined because the code did not set them; instead,
register_globals may have set it via user input through GET or POST.
I understand I may have to
recode if I turn them off, but is there a simple way to turn them off
and see if the code still works?

Modify php.ini, set register_globals=Off.

--
Andy Hassall :: an**@andyh.co.uk :: http://www.andyh.co.uk
http://www.andyhsoftware.co.uk/space :: disk and FTP usage analysis tool

[peter]

Thanks Andy! I guess what got me looking into this in the first place
was we received some of those strange emails where
ra***********@oursite.com are entered for all inputs and a CC is sent
to a different email address. A friend told me we may be vulnerable if
register_globals are on, which they are. Have you ever heard of such
emails? If so, will turning off register_globals protect us, or must
something more be done?

Thanks again,

Peter

[Jerry Stuckle]

peter wrote:

Thanks Andy! I guess what got me looking into this in the first place
was we received some of those strange emails where
ra***********@oursite.com are entered for all inputs and a CC is sent
to a different email address. A friend told me we may be vulnerable if
register_globals are on, which they are. Have you ever heard of such
emails? If so, will turning off register_globals protect us, or must
something more be done?

Thanks again,

Peter

Peter,

Turning off register_globals may or may not help. It all depends on how
the script was coded. Of course, if it were a secure script, the CC:
wouldn't be allowed, whether register_globals was on or off.

My suspicion is that the script itself is insecure, and turning
register_globals off won't help in this case. In any event, you really
should turn it off. The chances are pretty high if there is one problem
there could be others.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Ken Robinson]

peter wrote:

Thanks Andy! I guess what got me looking into this in the first place
was we received some of those strange emails where
ra***********@oursite.com are entered for all inputs and a CC is sent
to a different email address. A friend told me we may be vulnerable if
register_globals are on, which they are. Have you ever heard of such
emails? If so, will turning off register_globals protect us, or must
something more be done?

That is caused by some spammers trying to take over your email form.

Take a look at
<http://www.phpfreaks.com/forums/index.php?showtopic=66987&st=0&p=272101&#entry2721 01>

It shows some code that should keep these folks at bay.

I've gotten hit twice so far and a number of other people have also.

Ken

[peter]

Thanks for the link, Ken. I will recode. I've also had 2 groups of
this strange email. I'm wondering, though, if they have had success
with my form yet. I would think if they were sending spam from my
domain that I would inevitably get some returned emails and perhaps
angry emails as well. Do you think this is an accurate assessment?

Thanks,

Peter

[Ken Robinson]

peter wrote:

Thanks for the link, Ken. I will recode. I've also had 2 groups of
this strange email. I'm wondering, though, if they have had success
with my form yet. I would think if they were sending spam from my
domain that I would inevitably get some returned emails and perhaps
angry emails as well. Do you think this is an accurate assessment?

The only way to know for sure is to check the mail logs on your server.

Ken