- 论坛徽章:
- 0
|
今天翻了一下php manual Chapter 29. Using Register Globals
php4.2.0把register_globals默认值从on改成off, 原因是
- <?php
- // define $authorized = true only if user is authenticated
- if (authenticated_user()) {
- $authorized = true;
- }
- // Because we didn't first initialize $authorized as false, this might be
- // defined through register_globals, like from GET auth.php?authorized=1
- // So, anyone can be seen as authenticated!
- if ($authorized) {
- include "/highly/sensitive/data.php";
- }
- ?>
复制代码
When register_globals = on, our logic above may be compromised. When off, $authorized can't be set via request so it'll be fine
所以, 现在用$_POST[], $_GET[]这样的形式比较安全一点.
(4.2.0以前的phper, 可以通过给$authorized设置默认值来避免这个问题) |
|