In this whirlwind hack job to turn off register_globals, we have lost a
very useful feature.  Or maybe it was lost earlier and I didn't pay
attention.

Today you cannot set variables_order to "ES" and turn register_globals on
so that only E and S vars end up in the global symbol table.  If you do
this, then there is no way to get to G, P and C variables.
$HTTP_GET_VARS/$_GET do not get populated anymore when there is no G in
variables_order, for example.

This is a rather big shame as populating the global symbol table with at
least the server variables is a pretty safe thing to do.

It's ok that variables_order can be used to speed things up and tell PHP
not to hash stuff into the various arrays, but the approach of partially
filling globals and fetching the rest from the appropriate arrays is
useful.  So, I think we either need a new directive along the lines of

  force_hashing = "GPC"

or we need to simply always hash.  Or perhaps it would be a negative
subtracting directive like:

  never_hash = "E"

-Rasmus


-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]

Reply via email to