Programming PHP

Consider the following code:
This code assumes that $superuser can be set to true only if check_privileges( )
returns true.However, with register_globals enabled, it’s actually a simple matter
to call the page as page.php?superuser=1 to get superuser privileges.
There are three ways to solve this problem: initialize your variables, disable register_
globals in the php.ini file, or customize the variables_order setting to prevent GET,
POST, and cookie values from creating global variables.
Initialize Variables
Always initialize your variables.The superuser security hole in the previous example
wouldn’t exist if the code had been written like this:
If you set the error_reporting configuration option in php.ini to E_ALL, as discussed
in Chapter 13, you will see a warning when your script uses a variable before it initializes
it to some value.For example, the following script uses $a before setting it, so
a warning is generated:
Sample
Warning: Undefined variable: a in /home/httpd/html/warnings.php on line 7
Once your script is in a production environment, you should turn off public visibility
of errors and warnings, as they can give a potential hacker insight into how your script
works. The following php.ini directives are recommended for production systems:
display_errors = Off
log_errors = On
error_log = /var/log/php_errors.log
286 | Chapter 12: Security
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.