REGISTER_GLOBALS: A PHP Security Hazard

REGISTER_GLOBALS was once a controversial feature in PHP, prompting widespread condemnation. Its infamous reputation stems from the inherent security risks it posed.

So, What's the Problem with REGISTER_GLOBALS?

REGISTER_GLOBALS automatically creates global variables for all GET and POST request parameters, making them accessible anywhere in the script. This poses a significant threat as accessing undeclared variables is merely a warning in PHP, not an error.

Consider the following hypothetical code:

// $debug = true;
if ($debug) {
    echo "query: $query\n";
}

Without REGISTER_GLOBALS enabled, accessing the undeclared $query variable would result in a warning or error, prompting developers to explicitly define the variable. However, with REGISTER_GLOBALS on, the undeclared $query would still be available as a global variable, creating a potential avenue for attackers to exploit this undeclared parameter.

While not inherently bad, REGISTER_GLOBALS can exacerbate the security flaws prevalent in many PHP scripts due to their often deficient quality. As such, it is generally recommended to disable REGISTER_GLOBALS for enhanced security.