Apache and PHP, problem with variables

[Atle]

Okay, I'm not sure what to search for to find a solution to this, so I'll ask here. Hop it's the right forum.

I've set up apache and php4, and it mostly works. But I have a problem getting variables parsed from forms (actually set in the URL) to be read by the PHP script. The URL might look something like this http://192.168.1.27/index.php?page=main

Most php in the page will work, but part of the code is:

[Celtis]

It's not a bug, it's a configuration option, register_globals which is off by default. Have a look at http://uk.php.net/register_globals for reasons why the PHP devs themselves suggest that it stays off

Try using $_GET["page"] instead of just $page (it's better form and makes it easier to follow!).

[DavidMCS]

More than likely register_globals = Off in your php.ini.

You should actually write your scripts so they do not require register_globals to be turned on. Form variables with global scope can easily lead to security vulnerability problems. Instead access your posted form variables using the new superglobal arrays of $_POST and $_GET depending on the method your form uses to submit the data.

Try the following...

[hanj]

I'd be concerned about your code.. looks like you would be open to directory/file traversal. Not knowing your server configurations.. you may be able to read other files...

http://192.168.1.27/index.php?page=../../../etc/passwd for example.

or potentially cause a DoS via loop:

http://192.168.1.27/index.php?page=index.php

You may want to implement openbase_dir, safe_mode and client input filtering. Make sure you follow the above advise and use the $_GET array instead of turning on register_globals.. that would be a bad thing to do.

HTH
hanji

[Atle]

Thank you guys, both for the help and the security tips.