From PHP 4.2 onwards, the default behaviour of PHP is to have register_globals set to off. We suggest you do NOT change this setting as it will affect the security of your PHP scripts.

This does mean you will probably have to adjust many older scripts you have written yourself, and probably any you have downloaded from the net too (although if a PHP project is still active it is very likely the project will have been updated to the new, more secure way PHP works). If you really want to stick with the insecure way, see how to force register_globals to be on.

This setting affects the way PHP scripts receive data via the POST or GET http methods (i.e. fill-in HTML forms, URL query strings) and any data presented in a cookie or session data.

With register_globals on (the old way) if a variable is submitted, such as $username via an HTTP POST, it could be overwritten by other means, such as setting a session cookie with a different username. This can be a big security hole by allowing malicious users of your site to submit data to your scripts that they would not normally be expected to be able to do.

With register_globals set to off (our default setting, and the new way PHP now is installed by defulat), there are new safer arrays that contain the variable contents.

Under the new way of doing things in PHP, a POST variable that gets submitted by your site visitor will have its contents available to your script in a variable called $_POST["username"]

Global arrays available in PHP

The information available via global variables in PHP can now be found in the following arrays:

• $_GET - for variables sent using GET method
• $_POST - for variables sent using POST method
• $_COOKIE - for HTTP cookie variables
• $_SERVER - for server variables (e.g. REMOTE_ADDR)
• $_ENV - for environment variables
• $_SESSION - for HTTP variables originating from the session module

The PHP site has a comprehensive list of gloabl arrays that are available to your scripts.

Last updated 07 Apr 2005

Do you have any suggestions or comments on this page?