register_global Question?

[Trium918]

I would like to include this into all my files. Would this be a security hazard? If so,
how and what could I do to improve it?
<?php
/************************************************************/
/* If register_globals is not set then import them	    */
/* Import GET/POST/Cookie variables into the global scope   */
/************************************************************/
if (!ini_get('register_globals')) {
@import_request_variables("GPC", "");
}
?>

[Daniel0]

There is a reason why register globals is turned off by default in PHP5 and removed in PHP6. It's bad style and opens up for a variety of security issues. Just use the superglobals.

[Trium918]

There is a reason why register globals is turned off by default in PHP5 and removed in PHP6. It's bad style and opens up for a variety of security issues. Just use the superglobals.

 

I understand that, but you still haven't answered my question?

I have register_globals = Off inside of my php.ini.

 

Is import_request_variables turning register_global = On or is it

just importing them. I am trying to build a Content Management System,

so I would hate to use superglobals $_GET $_POST etc.. in each file. 

 

Thanks!

[Daniel0]

It doesn't turn it on, but it'll work like that. I strongly recommend against it though.

[Trium918]

It doesn't turn it on, but it'll work like that. I strongly recommend against it though.

 

Ok, how could I improve this? How could I initialize superglobals in lets say in

include.php and include it in all of my files? I am looking for an example.

 

Thanks!