[Open] Register_globals = ON ?

[Archertech]

Why is the register_globals=on

When it has been clearly established that is open up security vulnerabilities ??? It even comes OFF by default on all PHP versions now .. then why leave it on ???

[msd]

I have the same question... The security problem is critic...
And some scripts do not work properly with register_globals = on.
Support, would it be possible to have it switched to off?!

[GatorJustin]

I will speak to Brent about this and see what can be done.

[sonic]

A lot of scripts would not work with register_globals=OFF, for example OSCommerce would not work. I believe it is better to have register_globals=on server wide (as it is now), and set it off locally using your .htaccess

Cheers

[vandora]

I've seen many problems with php scripts and register_globals off... please don't turn it off!

[Archertech]

There are even bigger problems with register_globals = on ... like account susceptible to hack attacks on php scripts ... So its a simple pick ... Fix your scripts, Get Updated versions OR ... be susceptible to attacks on your websites ... allowing people complete access to your accounts .... i mean ... it doesnt take rocket science to put 2 and 2 together.

[GatorJustin]

Ok, the general consensus is that if we were default this to OFF, we would see a rapid increase in support emails and forum posts from people asking why their scripts stopped working.

We can't please everyone, so instead what we try to do is please the majority, and from what I'm hearing, the majority of people require this to be ON.

Also, as sonic mentioned, you do have the option to disable this using an .htaccess file.

[msd]

Ok. I don't want to cause trouble to other people... just want to solve mine...
In order to set it OFF, I added...
php_flag register_globals 0
... in my .htaccess. But now I get a 500 Internal server error: "The server encountered an internal error or misconfiguration and was unable to complete your request". Any idea about how to solve this problem?!

Thanks!!

[GatorJustin]

I would think that "0" would work, but try it with "off" instead...

php_flag register_globals off

[sonic]

It should be:

php_value register_globals 0

HTH

[msd]

Hi,

Jutin and sonic, thanks for the help. Just in case, I've already tried both options (0 and off), but the 500 error continued.

So, I tried to set it to 1 (ON), and the 500 error continues... So, my guess is that I don't have permission to have a .htaccess file. Is that possible?!

Before I ask support about this, does anyone else have a .htaccess file (changing the register_globals) working?!

Thanks!!!

[Archertech]

No ... you do have permissions to a .htaccess file .. are you sure you named it correct ?? Windows will not let you name the file starting with a "." therefore you have to rename it AFTER you upload it.

theoratically .. .htaccess files can be used inside ANY folder of your public_html .... but puttin it on the home directory is a good idea.

I am myself using .htaccess to hide PHP Sessid ... and it seems to be working like a charm. Do check your settings and file name.

[sonic]

Originally Posted by msd

Before I ask support about this, does anyone else have a .htaccess file (changing the register_globals) working?!

It works fine for us

Cheers

[msd]

Hi Archertech,

Thanks for you help!
The .htaccess file was fine. But it was not in my home directory.
Based on your comment, I edited the .htaccess file that was at my home directory (I haven't noticed I had one there before... ), adding the line:

php_value register_globals 0

But the 500 error happened again... when I remove this line, it works fine (no error). So the problem really seems to be when I try to change the php_flag... Any suggestions?!

[msd]

Thanks sonic.

So, I'll contact support... it seems to be a specific problem with my account ...

Thanks to everyone!!!