PHP MySQL - Stilson.net

CHAPTER 2• CONFIGURING YOUR ENVIRONMENTwww.it-ebooks.infoPHP is capable of automatically generating URLs and uses the standard ampersand (&) to separateinput variables. However, if you need to override this convention, you can do so by using thearg_separator.output directive.arg_separator.input = stringScope: PHP_INI_ALL; Default value: ;&;The ampersand (&) is the standard character used to separate input variables passed in via the POSTor GET methods. Although unlikely, should you need to override this convention within your PHPapplications, you can do so by using the arg_separator.input directive.variables_order = stringScope: PHP_INI_ALL; Default value: GPCSThe variables_order directive determines the order in which the ENVIRONMENT, GET, POST, COOKIE, andSERVER variables are parsed. While seemingly irrelevant, if register_globals is enabled (notrecommended), the ordering of these values could result in unexpected results due to later variablesoverwriting those parsed earlier in the process.register_globals = On | OffScope: PHP_INI_SYSTEM; Default value: OffIf you have used a pre-4.0 version of PHP, the mere mention of this directive is enough to evokegnashing of the teeth and pulling of the hair. To eliminate the problems, this directive was disabled bydefault in version 4.2.0, but at the cost of forcing many long-time PHP users to entirely rethink (and insome cases rewrite) their web application development methodology. This change ultimately serves thebest interests of developers in terms of greater application security. If you’re new to all of this, what’s thebig deal?Historically, all external variables were automatically registered in the global scope. That is, anyincoming variable of the types COOKIE, ENVIRONMENT, GET, POST, and SERVER were made availableglobally. Because they were available globally, they were also globally modifiable. Although this mightseem convenient, it also introduced a security deficiency because variables intended to be managedsolely by using a cookie could also potentially be modified via the URL. For example, suppose that asession identifier uniquely identifying the user is communicated across pages via a cookie. Nobody butthat user should see the data that is ultimately mapped to the user identified by that session identifier. Auser could open the cookie, copy the session identifier, and paste it onto the end of the URL, like this:http://www.example.com/secretdata.php?sessionid=4x5bh5H793adKThe user could then e-mail this link to some other user. If there are no other security restrictions inplace (e.g., IP identification), this second user will be able to see the otherwise confidential data.Disabling the register_globals directive prevents such behavior from occurring. While these externalvariables remain in the global scope, each must be referred to in conjunction with its type. For example,the sessionid variable in the previous example would instead be referred to solely as the following:$_COOKIE['sessionid']Any attempt to modify this parameter using any other means (e.g., GET or POST) causes a newvariable in the global scope of that means ($_GET['sessionid'] or $_POST['sessionid']). In Chapter 3,30