473,385 Members | 1,326 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,385 software developers and data experts.

Should I design for servers with register_globals switched off?

Hello

My current host has register_globals switched on in their php.ini file.

Would it be prudent for me to design code which works when register_globals
is switched off in case I switch hosts in the future? If I dont is it
normally straightforward to edit the code so that a script can be run with
register_globals off in the future?

Just trying to future proof my work abit.

Simon


Jul 16 '05 #1
5 2201
Thanks for the response...

Are there are other 'fundamental tips' you may have regarding how you should
code now to avoid potential difficulties when changing servers in the
future?

"stephan beal" <st*****@wanderinghorse.net> wrote in message
news:bf**********@ork.noris.net...
ChronicFatigue wrote:
Would it be prudent for me to design code which works when
register_globals is switched off in case I switch hosts in the future?
If
YES, and not only for that reason. Try maintaining someone's code which is
scattered across 10 php files and uses global variables. It's damned near
impossible. Avoid globals at all costs.

--
----- stephan beal
Registered Linux User #71917 http://counter.li.org
I speak for myself, not my employer. Contents may
be hot. Slippery when wet. Reading disclaimers makes
you go blind. Writing them is worse. You have been Warned.

Jul 16 '05 #2
ChronicFatigue wrote:
Thanks for the response...

Are there are other 'fundamental tips' you may have regarding how you
should code now to avoid potential difficulties when changing servers in
the future?


a) avoid the use of paths in your code. e.g., include(
"dir/anotherdir/something.inc.php" );

b) instead of using include() and require(), write classloader-like
replacements for them and use those to find your files for you. This is not
as hard as it sounds: 1 hour of work or so. Contact me off-list if you'd
like some sample code.
old style:
include( 'path/to/foo.inc.php' );
more generic approach:
my_include( 'foo' );

c) if you make heavy use of classes, write a classloader (they're EASY to
implement in PHP). Again, contact me off-list if you'd like some sample
code for this.
old style:
include( '/path/to/Foo.class.php' );
$foo = new Foo();
with classloader:
$foo =& classload( 'Foo' );
if( ! $foo ) { /* it didn't find the class */ }

d) avoid global vars at all costs. For example, i use the following function
to get at global vars:
################################################## ##############################
# r_find_var():
# i was sick of trying to figure out if a var was in GLOBALS or one of
# HTTP_xxx_VARS, so i wrote this laziness fixer.
# Looks in GLOBALS, HTTP_(POST,GET,SERVER,COOKIE)_VARS (in that order)
# for the given var, or returns a reference to $defaultval.
function & r_find_var( $var, $defaultval = null ) {
global $HTTP_COOKIE_VARS, $_r_flags;
foreach( array(
$GLOBALS,
$_GET,
$_POST,
$_SERVER,
$_COOKIES
)
as $ar ) {
if( isset( $ar[$var] ) ) return $ar[$var];
}
return $defaultval;
}
Then all of your global lookups look like:

$foo =& r_find_var( 'field_from_form', 42 );
if( $foo == 42 ) { /* it wasn't set */ }

This saves you from the primacy of things like:

$foo = $_POST['foo'];
if( ! $foo ) { $foo = $_GET['foo']; }
if( ! $foo ) { $foo = $GLOBALS['foo']; }
// ad nauseum...

i really think those are the most important bits. i cannot over-state the
maintenance benefits of using a classloader and classloader-like
replacements for include() and require(). They make your code much more
mobile and much easier to maintain. With those you can move your included
files whereever you like, update one config file (which is part of your
app, not part of the PHP setup) and you don't have to change any other
code.

:)

About the sample code: you can find it buried in the source tarball
available here if you like:
http://stephan.rootonfire.org/radioaqtiph/
the more generic bits are in classes/core/*.class.php
but some of those classes aren't useful and may be downright bogus
(TypedList.class.php comes to mind).

There you can also find an example of a classloader which CREATES classes on
the fly from a mysql database.

--
----- stephan beal
Registered Linux User #71917 http://counter.li.org
I speak for myself, not my employer. Contents may
be hot. Slippery when wet. Reading disclaimers makes
you go blind. Writing them is worse. You have been Warned.

Jul 16 '05 #3
Excellent post Stephan thanks for this.

Will look into these points you mention and thanks for the offer of sample
code.


"stephan beal" <st*****@wanderinghorse.net> wrote in message
news:bf**********@ork.noris.net...
ChronicFatigue wrote:
Thanks for the response...

Are there are other 'fundamental tips' you may have regarding how you
should code now to avoid potential difficulties when changing servers in
the future?
a) avoid the use of paths in your code. e.g., include(
"dir/anotherdir/something.inc.php" );

b) instead of using include() and require(), write classloader-like
replacements for them and use those to find your files for you. This is

not as hard as it sounds: 1 hour of work or so. Contact me off-list if you'd
like some sample code.
old style:
include( 'path/to/foo.inc.php' );
more generic approach:
my_include( 'foo' );

c) if you make heavy use of classes, write a classloader (they're EASY to
implement in PHP). Again, contact me off-list if you'd like some sample
code for this.
old style:
include( '/path/to/Foo.class.php' );
$foo = new Foo();
with classloader:
$foo =& classload( 'Foo' );
if( ! $foo ) { /* it didn't find the class */ }

d) avoid global vars at all costs. For example, i use the following function to get at global vars:
################################################## ##########################
#### # r_find_var():
# i was sick of trying to figure out if a var was in GLOBALS or one of
# HTTP_xxx_VARS, so i wrote this laziness fixer.
# Looks in GLOBALS, HTTP_(POST,GET,SERVER,COOKIE)_VARS (in that order)
# for the given var, or returns a reference to $defaultval.
function & r_find_var( $var, $defaultval = null ) {
global $HTTP_COOKIE_VARS, $_r_flags;
foreach( array(
$GLOBALS,
$_GET,
$_POST,
$_SERVER,
$_COOKIES
)
as $ar ) {
if( isset( $ar[$var] ) ) return $ar[$var];
}
return $defaultval;
}
Then all of your global lookups look like:

$foo =& r_find_var( 'field_from_form', 42 );
if( $foo == 42 ) { /* it wasn't set */ }

This saves you from the primacy of things like:

$foo = $_POST['foo'];
if( ! $foo ) { $foo = $_GET['foo']; }
if( ! $foo ) { $foo = $GLOBALS['foo']; }
// ad nauseum...

i really think those are the most important bits. i cannot over-state the
maintenance benefits of using a classloader and classloader-like
replacements for include() and require(). They make your code much more
mobile and much easier to maintain. With those you can move your included
files whereever you like, update one config file (which is part of your
app, not part of the PHP setup) and you don't have to change any other
code.

:)

About the sample code: you can find it buried in the source tarball
available here if you like:
http://stephan.rootonfire.org/radioaqtiph/
the more generic bits are in classes/core/*.class.php
but some of those classes aren't useful and may be downright bogus
(TypedList.class.php comes to mind).

There you can also find an example of a classloader which CREATES classes on the fly from a mysql database.

--
----- stephan beal
Registered Linux User #71917 http://counter.li.org
I speak for myself, not my employer. Contents may
be hot. Slippery when wet. Reading disclaimers makes
you go blind. Writing them is worse. You have been Warned.

Jul 16 '05 #4
ChronicFatigue wrote:

My current host has register_globals switched on in their php.ini file.


Simon,

I'm guessing you don't have access to the php.ini file, but you can
probably turn register_globals off using phpflag... I'm sure you
probably already know, but it's better if you can code with it off
instead of on.

Marcus

Jul 16 '05 #5
sam wrote:
Me too: Excellent post Stephan thanks for this.
Thanks :)
I think there is a scurity problem with your function r_find_var
(if you haven't an other function or like to check for variable
injection): One can easily inject variables into the $_GET array to
override $_SERVER variables. For example:


Oh, absolutely. i'm the last person in the world to feel concerned about
security, though ;). Seriously, though, for the type of coding i do it is
completely insignificant whether someone forges a form, because all data
authentication still requires a valid user. For example, i've implemented a
unix-like access rights system that gets applied to all of my database
tables, and any forms which end up updating db fields must then pass that
security.
--
----- stephan beal
Registered Linux User #71917 http://counter.li.org
I speak for myself, not my employer. Contents may
be hot. Slippery when wet. Reading disclaimers makes
you go blind. Writing them is worse. You have been Warned.

Jul 16 '05 #6

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
by: Frank | last post by:
Whats best : register_globals ON ? OR register_globals OFF ? I currently use: $_POST
10
by: John | last post by:
Hello. I am a newbie to PHP. I am over halfway through my first book that I'm learning with and have just created login pages etc. I just wondered, if I am running php/mysql/apache locally,...
6
by: wonder | last post by:
Hi, The CRM application said that need to add an option "REGISTER_GLOBALS=On" to the php.ini file, so I did what it told. But I still can't get rid off the following error: The PHP variable...
43
by: grz02 | last post by:
Hi, Im an experienced database+software designer and developer, but, unfortunately, anything to do with web-programming and web-systems designs is still a pretty new area to me... (been working...
4
by: Chris Gatto | last post by:
Hello, My organization is currently considering the purchase of a new intranet application server and we are looking for opinions from those who have been down this road before. In brief the...
6
by: peter | last post by:
Hi. I am just learning PHP. I'm taking over the website at work, which is coded in PHP. I am wondering about register_globals. They are on on the server we use. Is that a threat? I understand...
17
by: peter | last post by:
I just took over the website at work. I am still learning PHP. Register_globals are on and the script appears to be coded to take advantage of this. I know how to recode the script, but am unsure...
6
by: Terry Bell | last post by:
We've had a very large A97 app running fine for the last seven years. I've just converted to SQL Server backend, which is being tested, but meanwhile the JET based version, running under terminal...
8
by: +mrcakey | last post by:
I understand that register_globals was turned off by default as, unless you initialised it, it could be altered by a malicious coder. What I don't understand is how the $_POST form is any more...
1
by: CloudSolutions | last post by:
Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 3 Apr 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome former...
0
by: ryjfgjl | last post by:
In our work, we often need to import Excel data into databases (such as MySQL, SQL Server, Oracle) for data analysis and processing. Usually, we use database tools like Navicat or the Excel import...
0
by: aa123db | last post by:
Variable and constants Use var or let for variables and const fror constants. Var foo ='bar'; Let foo ='bar';const baz ='bar'; Functions function $name$ ($parameters$) { } ...
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.