PHP Session variables automatically assigned to regular variables

Question

I'm hosted at IX webhosting, and I came across something that struck me as strange. All my $_SESSION variables are automatically assigned to a regular variable of the same name. Is that normal PHP behavior? I looked it up in the php.net manual and didn't find an answer. Here's an example script:

<?php
$_SESSION['myvar'] = "hello";
echo $myvar; // after a page refresh, displays hello

$myvar = "goodbye";
echo $_SESSION['myvar']; // displays goodbye
?>

On my localhost I get an error msg in the likes of undefined variable: $myvar but at IX, the script works! Hazardous or normal PHP behavior? Thanks in advance.

What @zerkms said. And this is why everyone makes fun of PHP. — Ben Lee
– Ben Lee, Commented Mar 8, 2012 at 23:47

Joachim Isaksson · Accepted Answer · 2012-03-08 23:52:41Z

3

This "feature" controlled by a php.ini directive called register_globals. It has been disabled by default since PHP 4.2 and totally removed in PHP 5.4.

Unless you have legacy code depending on it, I would sincerely recommend that you turn it off if you can. Suffice to say, the security implications are pretty major.

edited Mar 8, 2012 at 23:52

answered Mar 8, 2012 at 23:47

Joachim Isaksson

182k28 gold badges298 silver badges308 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

cHao Over a year ago

And if you can't turn it off, consider switching web hosts. :P Yeah...it's that bad.

bob dope Over a year ago

It is incredibly bad. They only offer to turn it off with a custom cgi php.ini called from a .htaccess file ... Is that safe/efficient enough?

Joachim Isaksson Over a year ago

@bobdope As long as you can turn it off site wide with a single .htaccess file, it should be a perfectly ok solution. Of course default off would be a better solution, if you set another account up, you'll otherwise have to remember to do the same thing again.

Collectives™ on Stack Overflow

PHP Session variables automatically assigned to regular variables

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related