I'm looking to increase the security of my sites by turning their REGISTER_GLOBALS to OFF

I was told I ought to make a php.ini, and i've Googled tons about it. I'm seeing lots of different versions out there, leaving more confused the more I read than achieving solutions.

so, Would you recommend a good, Standard php.ini to use for the purpose of turning the R-Globals to OFF?


thanks,
Lashtal

a friend just told me I should do the following...

1) create a file called "php.ini"

2) put the following text in it: "register_globals=Off"

3) upload to root directory.


Should I keep that friend or get a new one?

That's a good thing to add. Check the php site for values in the php.ini file and what they mean along with recommendations for settings.

Does your hosting still have regster_globals on? Is it run by schoolboys? Check phpinfo(), I am sure that you do not have to bother about it.

I had called the customer support from Godaddy.com, and I asked him: "Are register globals set to OFF?"

He looked at my hosting account, saying some people have a file in there that already sets it to off, while some people do not. He didn't have a good reason as to why this may be so, but he said it was "a rather funny thing."

Anyhow, he finds out my account wasn't set to OFF

So he told me I ought to make a php.ini

So that's what I did.

In this case I'd rather use .htaccess entry: php_flag register_globals off

What I would recommend is to start with the php.ini file your web host is currently using. If you have shell access, you can simply copy the file into your own directory. It's usually located in /usr/lib, but if it isn't, then you can verify the location by calling the phpinfo function which will tell you where the configuration file is (amongst other things).

Once you've got a copy of the default php.ini file in your own directory, go ahead and edit it to your liking, turn register globals off and any other changes you would like to make.

Then, create a .htaccess file in your root document directory and add the following line:

SetEnv PHPRC /path/to/directory/containing/YOUR/php.ini

Then view the phpinfo function output again to ensure your configuration file is the one that's loaded.

To view phpinfo output, simply create a php file with the following code, then load the file in your browser.

<?php echo phpinfo(); ?>

OMG

Most directives that you need can be set with php_value or php_flag in .htaccess. Most directives that you cannot set that way will not be affected by adding your own php.ini anyway so it is not worth bothering about.

And BTW, should not you restart apache after adding new php.ini file into the system?