Hello, A register_globals=on is not a security issue for Oscommerce. Especially for Ms2.2 version. It have some vulnerabilites, of course, but very very low (i.e. someone could steal customers info - name, surname, telephone) - also not so easy. And thats all, no security leaks within register_globals. But if you wish to use register_globals=OFF besides, you could use one of the contributions made for this, search a community/ contributions of the official oscommerce site, or wait until MS3 release will be out - it will have this support.