New Year's Resolution: Learn PHP

I've made a few attempts at learning PHP recently, half-heartedly. NYR is to study it properly... I've ditched the Dummies book and have started with "Beginning PHP5" by Dave Mercer.

So far so good, but I have just got to a bit about the settings register_globals = Off

I have PHP5 on my website hosts' server, (so thankfully I didn't have to brave the set-up process), but how can I find out what this setting is since it's not on my own server?

I have tried to use bits of script before which did not work, and a quick google suggested that it would be because the register_globals setting was not right for the program. But I can't remember which way it was supposed to be!

I am loathe to go any further with the book if the code won't work unless I can access this setting, as I can't.

Contacting my web host to ask them is really a last resort as I use a Bulgarian company, and the chances of me understanding the answer to this question in English are slim, in Bulgarian I stand no chance!

If you create a file phpinfo.php with:

PHP Code:

<?php phpinfo();

... and run it in your browser, you can see all of your configuration settings. Just use your browsers "Find in page" feature to search for regsiter_globals.

It is probably on if you are using a shared host. Most experts agree that the option is harmful, but some legacy scripts may depend on it so most shared hosts keep it on. Having it on however does not stop you from writing good, safe, clean code. Basically the setting is only meaningful when you write code that specifically expects this option on (which is always bad code). If you are writing good, secure code, then this option is of little consequence.

It seems doubtful that your book is using code samples that require register_globals, so while you are learning it's unlikely that this setting should make any difference to you at all. But if you have not already, learn about what register_globals actually does.

Originally Posted by Christopher

If you create a file phpinfo.php with:

PHP Code:

<?php phpinfo();

... and run it in your browser, you can see all of your configuration settings. Just use your browsers "Find in page" feature to search for regsiter_globals.

It is probably on if you are using a shared host. Most experts agree that the option is harmful, but some legacy scripts may depend on it so most shared hosts keep it on. Having it on however does not stop you from writing good, safe, clean code. Basically the setting is only meaningful when you write code that specifically expects this option on (which is always bad code). If you are writing good, secure code, then this option has little consequence.

It seems doubtful that your book is using code samples that require register_globals, so while you are learning it seems unlikely that this setting should make any difference to you at all. But if you have not already, learn about what register_globals actually does.

THANKS!!!

So I have discovered that they are OFF. I guess that's good from a security point of view then? If I understand it correctly, they are dangerous if ON and if I am find a script which says they need to be on I should probably avoid that script anyway?

Note the closing tag was omitted in the post above:

<?php
// Show all information, defaults to INFO_ALL
phpinfo();
?>

If I understand it correctly, they are dangerous if ON and if I am find a script which says they need to be on I should probably avoid that script anyway?

That's exactly right These days though it is very very uncommon to find such a script, so you shouldn't worry. Indeed, the register_globals setting will be completely removed in PHP6.

Note the closing tag was omitted in the post above:

Purposefully The closing tag is not required, and saves possible headaches to do with trailing whitespace (i.e., "headers already sent" and the like). I never include closing tags unless I have to mix PHP with markup.

Originally Posted by Christopher

Purposefully The closing tag is not required, and saves possible headaches to do with trailing whitespace (i.e., "headers already sent" and the like). I never include closing tags unless I have to mix PHP with markup.

Yep!

Originally Posted by colbyt

Note the closing tag was omitted in the post above:

Well there you go! I had actually put the closing tag in myself anyway, thinking how clever I was, but it turns out it wasn't necessary!

Thanks again for your help

Later on you will know enough to rework a "global_on" script to make it work in the off mode. For now they are best avoided.