Disabling global vars without php.ini access?

[David Walker]

I've got a server where register_global s is on in php.ini, but its affecting
the way the website works. It was programmed with the assumption that it
would always be off, and i've always used the full names such as
$_SESSION['userid'] etc in all the code. However, I also use some local
variables of $userid, and on this server they seem to be changing the
session variable when I use them. I don't have access to php.ini, and its
on a Win2000 server so can't use htaccess. According to the documentation,
I can't set it at runtime with ini_set.

So, is there any way I can disable the operation of register globals /
superglobal variables in this situation? I really don't want to go through
and change all my variable names, since that is exactly why I made sure to
use the full variable name every time for sessions, post and get values.
Thanks

David

[Jedi121]

Re: Disabling global vars without php.ini access?

"David Walker" a écrit le 05/11/2003 :[color=blue]
> I've got a server where register_global s is on in php.ini, but its affecting
> the way the website works. It was programmed with the assumption that it
> would always be off, and i've always used the full names such as
> $_SESSION['userid'] etc in all the code. However, I also use some local
> variables of $userid, and on this server they seem to be changing the
> session variable when I use them. I don't have access to php.ini, and its
> on a Win2000 server so can't use htaccess. According to the documentation,
> I can't set it at runtime with ini_set.
>
> So, is there any way I can disable the operation of register globals /
> superglobal variables in this situation? I really don't want to go through
> and change all my variable names, since that is exactly why I made sure to
> use the full variable name every time for sessions, post and get values.
> Thanks
>
> David[/color]

Maybe you could try to browse through the $_POST, $_GET and $_COOKIE
vars and unset the correspondant var at the beginning of your scripts :

foreach( $_POST AS $key => $val )
{
unset $$key;
}

Without any warranty, not tried.

[David Walker]

Re: Disabling global vars without php.ini access?

> Maybe you could try to browse through the $_POST, $_GET and $_COOKIE[color=blue]
> vars and unset the correspondant var at the beginning of your scripts :
>
> foreach( $_POST AS $key => $val )
> {
> unset $$key;
> }[/color]

I still want to be able to access those variables though. For example, the
userid variable I have.

Pages on the site with restricted access check that value as a session
variable, as $_SESSION['userid'], but on a page like that I may be changing
someone elses details, for which I use the local variable $userid. I want
to be able to use both separately on the same page.
I'd hoped for another way to disable global_variable s without php.ini
access.

David

[Terence]

Re: Disabling global vars without php.ini access?

David Walker wrote:
[color=blue][color=green]
>>Maybe you could try to browse through the $_POST, $_GET and $_COOKIE
>>vars and unset the correspondant var at the beginning of your scripts :
>>
>>foreach( $_POST AS $key => $val )
>>{
>>unset $$key;
>>}[/color]
>
>
> I still want to be able to access those variables though. For example, the
> userid variable I have.
>
> Pages on the site with restricted access check that value as a session
> variable, as $_SESSION['userid'], but on a page like that I may be changing
> someone elses details, for which I use the local variable $userid. I want
> to be able to use both separately on the same page.
> I'd hoped for another way to disable global_variable s without php.ini
> access.
>
> David
>
>[/color]

No, he didn't mean you unset them from the superglobal arrays, he meant
the CORRESPONDING variables (symbols).

ie.

foreach($_REQUE ST as $varName => $varVal) unset($varName) ;

notice that $_REQUEST is *still populated*. $_REQUEST includes $_GET,
$_POST, $_COOKIE (GPC). You need another foreach statement to take care
of $_SESSION

foreach($_SESSI ON as $varName => $varVal) @unset($varName );

stick that (both lines) at the top of your pages.

[R. Rajesh Jeba Anbiah]

Re: Disabling global vars without php.ini access?

"David Walker" <wbsdavenews@ho tmail.com> wrote in message news:<bobs2r$3k b$1@wisteria.cs v.warwick.ac.uk >...[color=blue]
> I've got a server where register_global s is on in php.ini, but its affecting
> the way the website works. It was programmed with the assumption that it
> would always be off, and i've always used the full names such as
> $_SESSION['userid'] etc in all the code. However, I also use some local
> variables of $userid, and on this server they seem to be changing the
> session variable when I use them.[/color]

Is it the problem that I reported once? (
http://bugs.php.net/bug.php?id=22389 )


---
"The world is too dangerous to live in—not because of the people who
do evil, but because of the people who sit and let it happen"---Albert
Einstein
Email: rrjanbiah-at-Y!com

[David Walker]

Re: Disabling global vars without php.ini access?

> No, he didn't mean you unset them from the superglobal arrays, he meant[color=blue]
> the CORRESPONDING variables (symbols).
> ie.
> foreach($_REQUE ST as $varName => $varVal) unset($varName) ;[/color]

Ahh yeah - I see what you mean now *it all clicks into place*
I'll give it a go when I get back in tonight, see what happens.

Thanks

David

[David Walker]

Re: Disabling global vars without php.ini access?

> Is it the problem that I reported once? ([color=blue]
> http://bugs.php.net/bug.php?id=22389 )[/color]

Yeah, sounds the same - just confirms that i'll probably just have to change
all my variable names! :o(

David

[R. Rajesh Jeba Anbiah]

Re: Disabling global vars without php.ini access?

"David Walker" <wbsdavenews@ho tmail.com> wrote in message news:<bocvg4$f9 5$1@wisteria.cs v.warwick.ac.uk >...[color=blue][color=green]
> > Is it the problem that I reported once? (
> > http://bugs.php.net/bug.php?id=22389 )[/color]
>
> Yeah, sounds the same - just confirms that i'll probably just have to change
> all my variable names! :o([/color]

AFAIK, it is true for 4.3.0. IIRC, it has been fixed in 4.3.2.
So, try to upgrage your PHP.

---
"Learn from yesterday, live for today, hope for tomorrow. The
important thing is to not stop questioning."---Albert Einstein
Email: rrjanbiah-at-Y!com