register globals question

[mtkauff]

I am a complete php newbie, so take it easy on me.

I am just starting to build my site and delving into php when I come across the register globals issue. I see that it is set to on. After reading a few threads here I became completely confused. I assume for securities sake that it should be off, but it seems that this causes issues(?)

My site will be a community type site with members, databases, etc. and I want to make sure everything is secure. Do I set the register globals in the root php.ini file to off, or is there another way of doing this? A layman's explanation would be greatly appreciated.

I am wanting to get this right before I start implementing php into my site so I don't have to come back later to change things and possibly screw up any or all scripts I am using.

Mike

[mtkauff]

After looking at the root htaccess file, this was in the file:

<IfModule mod_suphp.c>
suPHP_ConfigPath /home/USERNAME/php.ini
<Files php.ini>
order allow,deny
deny from all
</Files>
</IfModule>

Doesn't this turn off the globals?

[striddy]

Originally Posted by mtkauff

I see that it is set to on.
.....
Do I set the register globals in the root php.ini file to off, or is there another way of doing this? A layman's explanation would be greatly appreciated

The easiest way is:

Cpanel > Software / Services > php.ini EZConfig > Enable EZConfig > locate register_globals > select Off > Save Changes > That's it.

[mtkauff]

Yeah, I noticed that striddy, but I was wondering if doing that created any other problems.

[mp3]

Register Globals isn't a security issue itself, but turning it off forces you to write safer code. Turning it off can also break scripts that rely on it.

I suggest that you always write scripts with register globals off, and don't run anything that requires it.

[phototristan]

It should really be defaulted to OFF by HostGator like every other reputable host.

[minndan]

I just looked and didn't see this: php.ini EZConfig

Can I just post an php.ini file and do it myself? I tried, by the way, and it didn't take:

register_globals = off

[minndan]

Ok, I got it to take. I thought if I put my php.ini file in the public_html folder, it would affect all subfolders. But it didn't seem to? Once I copied that file to the particular folder that needed it, it took.

Doesn't it normally affect all folders underneath it?

[kompreszor]

Try putting the php.ini at the ConfigPath location stated in your root .htaccess :-) That's how I have mine set up and it works fine.