PHP Includes not working after upgrade

[andy87]

I have used PHP includes for years now such that:

 

<?php
if ($go == "ga") $action2 = "ga";
elseif ($go == "ga06") $action2 = "ga06";
elseif ($go == "ga05") $action2 = "ga05";
elseif ($go == "ga04") $action2 = "ga04";
elseif ($go == "ga03") $action2 = "ga03";
elseif ($go == "ga07") $action2 = "ga07";
elseif ($go == "ga08") $action2 = "ga08";
else $action2 = "info2";
?>

 

And then

 

<?php include("$action2.html"); ?>

 

Therefore say the page was info.php...

 

- info.php would load the contents of info2.html where the include was

- info.php?go=ga08 would load the contents of ga08.html where the include was

 

...and so forth.

 

This has worked no problem and still works on one of my sites.

 

However, one web host recently did a server upgrade. The details stand as:

PHP version 5.2.5

Architecture i686

Operating system Linux

 

Now the outcome has changed to...

 

- info.php loads the contents of info2.html where the include is

- info.php?go=ga08 loads the contents of info2.html where the include is

 

...and so forth.

 

I've been told it can be to do with register_globals or something and is a security risk suddenly?!

 

Any solutions?

 

[pocobueno1388]

Try actually defining the variable $go. It probably was a change in register_globals.

 

<?php

$go = $_GET['go'];

if ($go == "ga") $action2 = "ga";
elseif ($go == "ga06") $action2 = "ga06";
elseif ($go == "ga05") $action2 = "ga05";
elseif ($go == "ga04") $action2 = "ga04";
elseif ($go == "ga03") $action2 = "ga03";
elseif ($go == "ga07") $action2 = "ga07";
elseif ($go == "ga08") $action2 = "ga08";
else $action2 = "info2";
?>

[kenrbnsn]

If your old code depended on register globals being enabled, which used to be before 2002, then I would change your code to something like:

<?php
<?php
$go = (isset($_GET['go']))?$_GET['go']:'';
if ($go == "ga") $action2 = "ga";
elseif ($go == "ga06") $action2 = "ga06";
elseif ($go == "ga05") $action2 = "ga05";
elseif ($go == "ga04") $action2 = "ga04";
elseif ($go == "ga03") $action2 = "ga03";
elseif ($go == "ga07") $action2 = "ga07";
elseif ($go == "ga08") $action2 = "ga08";
else $action2 = "info2";
?>

or to make your code shorter

<?php
<?php
$valid_actions = array('ga','ga06','ga05','ga04','ga03','ga07','ga08')
$action2 = (isset($_GET['go'] && in_array($_GET['go'],$valid_actions))?$_GET['go']:'info2';
?>

 

Ken

[PFMaBiSmAd]

[rant]

 

On the positive side, hosts are apparently following recommend php settings as they are upgrading php to the latest version (or perhaps they don't have a clue what settings they had before or are using now.)

 

On the negative side, they don't seem to be notifying their customers what they are actually changing and what impact each change could have on existing scripts.

 

How hard could it be to say "Register globals are being turned off. Any existing code with program variables that are magically being populated by post/get/cookie/session variables will need to be changed as follows ..."

 

Sadly, register globals were turned off in Version 4.2.0 22-Apr-2002. That was 6 full years ago. Hosts should have globally left them off and only turned them on in specific accounts when needed. Then perhaps there would not have been 6 years of development of new scripts that now need to be fixed.

 

[/rant]