What syntax I should change for register_globals off

[ulag]

After upgrading to latest PHP (4.3.0), I am facing problem with sessions variables, form variables and so on.

Right now most of hosting uses register_globals as on.

I changed few, but would like to know from others, to list what all should be changed?
I want the code should work either in register_globals on or off

PHP_SELF ==> $_SESSION['PHP_SELF'];
SESSION_REGISTER('VAR') ==> $_SESSION['VAR'];
ARRAY_KEY_EXISTS('VAR', $_SESSION);
UNSET($_SESSION['VAR']);
form positing ==> $HTTP_POST_VARS['VAR'];

Can others correct me and add missing things?

 

[skiflyer]

The first one I always use (and have always thought was correct) is actually
$_SERVER["PHP_SELF"];

The third one what you have works, but you can save yourself some typing and just use...

$_POST["VAR"];
for now on

And the second one you have exactly right as I can tell.

Good luck!

-Rob

 

[sleipnir214]

All of this is documented at

http://www.php.net/manual/en/reserved.variables.php

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[ulag]

The path of register_globals on/off seems to be still unclear.

First thing is I want to convert all my old code to register_globals off.
Is it worth to change my old code?
For my new project, I need to make sure write code register_globals off compliant.

Do any one has idea the what is the stand of register_globals in future PHP releases?

For example for global variable, they introduced
$HTTP_POST_VARS & $_POST and few suggest $_EXTRACT

Is there clear cut way to know which will be followed in future releases, so that, I do not change my code often?

http://www.php.net/manual/en/security.registerglobals.php

 

[sleipnir214]

register_globals is a runtime configuration directive in the file php.ini. I think that register_globals will continue to exist, and that its default value will continue to be "off".

I recommend writing code at all times as if register_globals is set to "off". First, for the reasons specified in the link you listed. Second, because it makes your code more maintainable -- in six months you may not be able to remember how a value got into $foo, but with $_POST['foo'], it's self-evident. Third, because it makes your code more portable -- if your code expects register_globals to be "off", then if it's "on", it won't bother your code, but the converse does not apply. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!