Re: [LIP] PHP_SELF not working

> They are divided in groups - like SERVER, GET, POST etc.
> Instead of writing $field1 you have to write $_POST['field1'] and 
> $_GET['field1'] - just like mentioned $_SERVER['PHP_SELF']

It depends on the version of php you are using. The newer versions have
$_SERVER, $_GET, $_POST, $_ENV, $_SESSION.

Sometimes back it was
$HTTP_SERVER_VARS, $HTTP_GET_VARS,$HTTP_POST_VARS,....

or something else in the previous versions.

> IN the newest versions of PHP the option register_globals is by 
> default set to no - there're serious safety reasons to do it :-)
I dont see any major threat if the main security related stuff are
safely coded and use the proper variable.

Like the examples i have seen, is mainly related to login where just
checking the flag for true or false allow you to login. So instead of
using the session variable it just checks for any variable in the order
specified in php.ini (default is EGPCS). 
Say the log_flag(Session variable) is the variable you are using to
check for valid login.
So if you are blindly checking if log_flag is set to true then you are
in trouble.

So once you take care that the main code explicitly use the variables
you can have register_globals on.


-- 
G.Vinubalaji

 MultiTech (())            
Software Systems


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html