The register_globals
directive:
register_globals
is an internal PHP setting which registers the $_REQUEST
array's elements as variables. If you submit a value in a form, via POST
or GET
, the value of that input will automatically be accessible via variable in the PHP script, named after the name of the input field.
In other words, if you submitted a form containing a username
text field, the expression ($username === $_POST['username'])
at the very beginning of the script would return true
.
Its notoriety is attributed to the fact that it opens lots of security holes, especially for people that follow anything less than a strict coding style from a security perspective.
Classic example:
if(user_is_admin($user))
{
$authorized = true;
}
if($authorized)
{
// let them do anything they want
}
Now, if you visited that script in a web browser and the server had register_globals
on, you could simply append ?authorized=1
to the URL and god-mode would be enabled!
The global
keyword:
global
is a keyword has little to do with register_globals.
Here is an example of its use:
$foo = 'bar';
baz();
function baz()
{
echo $foo; // PHP warns you about trying to use an uninitialized variable
// and nothing is output (because $foo doesn't exist here)
}
buzz();
function buzz()
{
global $foo; // Enables the use of $foo in this scope
echo $foo; // Prints 'bar' to screen
}
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…