turn globals off

  • Nem
  • Guru
  • Guru
  • No Avatar
  • Joined: Feb 13, 2004
  • Posts: 1243
  • Loc: UK
  • Status: Offline

Post July 6th, 2004, 12:48 pm

I have seen many threads, many scripts, many topics, many tutorials where it explains that globals need to be turned off?

:?

I have absolutely no clue what this means, and are using arrays safer to use that just normally inputting data?
  • Anonymous
  • Bot
  • No Avatar
  • Joined: 25 Feb 2008
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post July 6th, 2004, 12:48 pm

  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 6th, 2004, 12:55 pm

I think it's because many php applications have vulnerabilities that can be exploited if global variables is left on. Even the phpBB board has one that can be exploited.

A quick Google search for : globals + vulnerabilities will show you what I mean.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Nem
  • Guru
  • Guru
  • No Avatar
  • Joined: Feb 13, 2004
  • Posts: 1243
  • Loc: UK
  • Status: Offline

Post July 6th, 2004, 12:59 pm

How can i avoid this type of situation?
GSDomains.com -Click here - Packages starting from £3.69 a month. 1.5GB Space & 10GB Bandwidth.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 6th, 2004, 1:03 pm

turn globals off in php. If you don't have access to the server you would need to request it of your host. I don't run linux servers so I'm not sure how to tell you how to go about it, but there's probably several here who can.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Nem
  • Guru
  • Guru
  • No Avatar
  • Joined: Feb 13, 2004
  • Posts: 1243
  • Loc: UK
  • Status: Offline

Post July 6th, 2004, 1:14 pm

What exactly are globals, i seriously have no clue.
GSDomains.com -Click here - Packages starting from £3.69 a month. 1.5GB Space & 10GB Bandwidth.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 6th, 2004, 1:26 pm

http://www.strath.ac.uk/IT/Docs/Ccourse ... 3_6_3.html

Basically, the idea is that global variables can be used be all functions.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Nem
  • Guru
  • Guru
  • No Avatar
  • Joined: Feb 13, 2004
  • Posts: 1243
  • Loc: UK
  • Status: Offline

Post July 6th, 2004, 1:28 pm

Hey a question about sessions...

If a session is created, how will another page recognise who the user is by the session?? I mean say if there are 2 users, wont the script get confused?
GSDomains.com -Click here - Packages starting from £3.69 a month. 1.5GB Space & 10GB Bandwidth.
  • Scorpius
  • Proficient
  • Proficient
  • User avatar
  • Joined: Mar 20, 2004
  • Posts: 401
  • Loc: Scorpion Hole
  • Status: Offline

Post July 6th, 2004, 1:30 pm

Its pretty simple to turn off globals. If you have a Linux machine just go in /etc/php.ini and where it says
register_globals on
change it to
register_globals off
Although most hosting companies have it turned off by default because PHP now does that by default.
To check if you have it on or not, make a php file and just put
PHP Code: [ Select ]
<?php
 
   phpinfo();
 
?>
  1. <?php
  2.  
  3.    phpinfo();
  4.  
  5. ?>

and you will see all your variables.
Hope that was of some help to you.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 6th, 2004, 1:44 pm

phpBB uses a few methods to validate and remember users. This link explains it pretty well:

http://www.phpbb.com/kb/article.php?article_id=54

Truthfully nem, it's refreshing to see your tenacity at learning this, but you should take some real effort to study the code itself. For example, just take this phpBB board script and start to look at every file and study what each and every function and variable does. IMO this script is pretty highly developed and can teach a beginner a lot. I still consider myself a beginner at php and the study of this script is how I'm learning to understand it.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Nem
  • Guru
  • Guru
  • No Avatar
  • Joined: Feb 13, 2004
  • Posts: 1243
  • Loc: UK
  • Status: Offline

Post July 6th, 2004, 1:45 pm

Thanks atno for the advice.
GSDomains.com -Click here - Packages starting from £3.69 a month. 1.5GB Space & 10GB Bandwidth.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 6th, 2004, 1:50 pm

No prob. Another good learning tool is phpMyAdmin and study the structure of the tables in a script. For example as you'll note from the link above phpBB uses a combination of Session ID's (stored in the database and encrypted) and Cookies stored on the users machine. It's a huge challenge to do it right and get a good security in place. I suppose that's why the phpBB group is a "group" and not an individual. Most really good programs are not just written by one person.
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Nem
  • Guru
  • Guru
  • No Avatar
  • Joined: Feb 13, 2004
  • Posts: 1243
  • Loc: UK
  • Status: Offline

Post July 7th, 2004, 2:53 am

yeah, but what about invisionboard. I would say that board is more secure than phpbb.
GSDomains.com -Click here - Packages starting from £3.69 a month. 1.5GB Space & 10GB Bandwidth.
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post July 7th, 2004, 6:24 am

Really?

http://www.threatfocus.com/vuln_detail. ... t_id=12268
https://www.edgeos.com/threats/details.php?id=11977
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Nem
  • Guru
  • Guru
  • No Avatar
  • Joined: Feb 13, 2004
  • Posts: 1243
  • Loc: UK
  • Status: Offline

Post July 7th, 2004, 6:25 am

OUCH
GSDomains.com -Click here - Packages starting from £3.69 a month. 1.5GB Space & 10GB Bandwidth.
  • Tannu4u
  • Proficient
  • Proficient
  • User avatar
  • Joined: Apr 29, 2004
  • Posts: 480
  • Loc: India
  • Status: Offline

Post July 7th, 2004, 12:32 pm

I think that turning the globals of can protect u from being hacked.If globals are on then hackers can get the values of these globals from the streams and can have undue advantage.So to turn globals off is to make ur system operate more safely.
Amit
My Blog http://www.amityadav.name
  • Anonymous
  • Bot
  • No Avatar
  • Joined: 25 Feb 2008
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post July 7th, 2004, 12:32 pm

Post Information

  • Total Posts in this topic: 15 posts
  • Users browsing this forum: No registered users and 190 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
 

© 2011 Unmelted, LLC. Ozzu® is a registered trademark of Unmelted, LLC.