Using Register Globals
Perhaps the most controversial change in PHP is when the default
value for the PHP directive register_globals went from ON
to OFF in PHP 4.2.0. Reliance on this directive was quite
common and many people didn't even know it existed and assumed
it's just how PHP works. This page will explain how one can
write insecure code with this directive but keep in mind that
the directive itself isn't insecure but rather it's the misuse
of it.
When on, register_globals will inject (poison) your scripts
will all sorts of variables, like request variables from
HTML forms. This coupled with the fact that PHP doesn't
require variable initialization means writing insecure code
is that much easier. It was a difficult decision, but the
PHP community decided to disable this directive by default.
When on, people use variables yet really don't know for
sure where they come from and can only assume. Internal
variables that are defined in the script itself get mixed
up with request data sent by users and disabling register_globals
changes this. Let's demonstrate with an example misuse of
register_globals:
Example 15-14. Example misuse with register_globals = on
<?php
// define $authorized = true only if user is authenticated
if (authenticated_user()) {
$authorized = true;
}
// Because we didn't first initialize $authorized as false,
this might be
// defined through register_globals, like from GET auth.php?authorized=1
// So, anyone can be seen as authenticated!
if ($authorized) {
include "/highly/sensitive/data.php";
}
?>
When register_globals = on, our logic above may be compromised.
When off, $authorized can't be set via request so it'll
be fine, although it really is generally a good programming
practice to initialize variables first. For example, in
our example above we might have first done $authorized =
false. Doing this first means our above code would work
with register_globals on or off as users by default would
be unauthorized.
Another example is that of sessions. When register_globals
= on, we could also use $username in our example below but
again you must realize that $username could also come from
other means, such as GET (through the URL).
|
