Really odd problem

[hallucinated]

I have a local webserver set up where I run all my testing before I upload to my webserver. Here's the problem:

 

I have a session variable defined that contains a userid. I have a profile page that reads the userid of profiles with $_GET['userid']. This all works fine on my local webserver. However, online, whenever I click on profile.php?userid=2 (or whatever), my SESSION variable gets assigned to 2 (or whatever profile ID I am viewing). And this only happens when I am logged in.

 

To determine the cause of the error, I assigned a variable, $test, and set it equal to $_SESSION['userid']. This was to capture the session Id at any point during the running of the script. I narrowed it down to one line, before which the session ID is set to whatever you logged in with, and after which the session ID has changed to $_GET['userid'], from the profile.php?userid=somenumber. Now, here's the silly part, the line itself:

 

$profile = $_GET['userid'];

 

And another odd thing is that this works absolutely fine on my local server, but not my online webserver. Any ideas?

[PFMaBiSmAd]

Your on line server has register_globals turned on. Turn them off using a .htaccess file of a local php.ini file.

 

Register_globals were turned off in php4.2 in the year 2002 (6 years ago.) No new hosting accounts should have been created after that point in time that had register_globals turned on. Register_globals have been completely removed in upcoming php6.

 

And I would ask your host why it still has them turned on. They are a huge security hole, as you found out. Someone can become logged in or become an administrator by simply putting their values on to the end of a url and to set a session variable to their value instead of the value the script has set it to.