Dangers of REGISTER_GLOBALS

REGISTER_GLOBALS is a PHP setting that enables all GET and POST variables to be available as global variables within PHP scripts. This functionality may seem convenient, but its use is strongly discouraged due to potential security vulnerabilities and coding practices.

Why is REGISTER_GLOBALS Bad?

The primary issue with REGISTER_GLOBALS lies in its potential for exploitation. When GET or POST variables are inadvertently accessed as undeclared variables (which is allowed in PHP), it can lead to malicious code execution. This is especially concerning since PHP is commonly used for web development, where user input can be untrusted.

Example of Vulnerability

Consider the following PHP code:

if ($debug) {
    echo "query: $query\n";
}

With REGISTER_GLOBALS enabled, an attacker could easily inject a $query variable through a request to manipulate the script's behavior. This could lead to sensitive information disclosure, unauthorized file access, or even remote code execution.

Coding Best Practices

It is crucial to note that PHP code should be engineered to avoid accessing undeclared variables. Well-written code will properly declare and initialize all variables and should not rely on REGISTER_GLOBALS for convenience.

While REGISTER_GLOBALS can be used for quick and dirty scripts, it should generally be avoided in production code. By disabling REGISTER_GLOBALS and adopting clean coding practices, developers can greatly enhance the security and reliability of their PHP applications.