register_globals

Much has been made of the 'security risk' that can be created by the use of register_globals, but little is documented on where registering the EGPCS (Environment, GET, POST, Cookie, Server) variables automatically was used as a shortcut for passing data between the creation of page views. A number of legacy applications fail to function properly when this persistance is removed, and while the published bodges allow for the replication of the general function, the proper fixes may not be so obvious. On the whole it is normally just the addition of the relevent superglobal array name that is required, and for the Environment and Server variables these can be listed. However application designated variables tend to be a little more difficult to identify. Some of these are passed as GET or POST variables, while others

While the presence of the ini setting is displayed as DEPRICATED in 5.3 and ignored in 5.4 this sidesteps the actually problems created. The use of a good IDE platform is one way of identifying variables that are not initialized and also provides facilities to update all instances of a variable. We use Eclipse with PHPEclipse to handle the PHP files as part of an integrated platform for all code development.