Posted by Jerry Stuckle on 01/14/08 20:10

Kurda Yon wrote:
> OK. But, what is the problem with the "turned on register_globals"? I
> read about the problem here:
> http://shsc.info/ShittyPHPFeatures
>
> And they explain the problem by the following example:
> if ($_COOKIE['adminpassword'] == 'secret')
> $admin = TRUE;
> ...
> if ($admin) destroy_website();
>
> If somebody load the website like that:
> website.php?admin=1
> the website will be destroyed.
>
> But I do not understand how the given example is related with the
> global variables? The described example will be a problem even if the
> $admin is NOT a global variable. Isn't?
>

Because with register_globals on,

http://www.example.com?admin=1

sets $admin to 1 (true).


--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

• Next in forum: Re: Send to GPS - PHP Script?
• Prev in forum: Re: newbie help with mysql_fetch_array
• Thread view: Re: How to call the session variable?

[Reply to this message]