PHP MySQL - Stilson.net

www.it-ebooks.infoCHAPTER 2 • CONFIGURING YOUR ENVIRONMENTthe section on PHP’s superglobal variables offers a thorough introduction to external variables of theCOOKIE, ENVIRONMENT, GET, POST, and SERVER types.Although disabling register_globals is unequivocally a good idea, it isn’t the only factor you shouldkeep in mind when you secure an application. Chapter 21 offers more information about PHPapplication security.■ Note The register_globals feature has been a constant source of confusion and security-related problemsover the years. Accordingly, it has been deprecated as of PHP 5.3.0.register_long_arrays = On | OffScope: PHP_INI_SYSTEM; Default value: OffThis directive determines whether to continue registering the various input arrays(ENVIRONMENT, GET, POST, COOKIE, SYSTEM) using the deprecated syntax, such as HTTP_*_VARS.Disabling this directive is recommended for performance reasons.■ Note The register_long_arrays directive has been deprecated as of PHP 5.3.0.register_argc_argv = On | OffScope: PHP_INI_SYSTEM; Default value: OffPassing in variable information via the GET method is analogous to passing arguments to anexecutable. Many languages process such arguments in terms of argc and argv. argc is the argumentcount, and argv is an indexed array containing the arguments. If you would like to declare variables$argc and $argv and mimic this functionality, enable register_argc_argv.post_max_size = integerMScope: PHP_INI_SYSTEM; Default value: 8MOf the two methods for passing data between requests, POST is better equipped to transport largeamounts, such as what might be sent via a web form. However, for both security and performancereasons, you might wish to place an upper ceiling on exactly how much data can be sent via this methodto a PHP script; this can be accomplished using post_max_size.WORKING WITH SINGLE AND DOUBLE QUOTESQuotes, both of the single and double variety, have long played a special role in programming. Becausethey are commonly used both as string delimiters and in written language, you need a way to differentiatebetween the two in programming to eliminate confusion. The solution is simple: escape any quote mark31