$var instead of $_GET['var'] in PHP?

Question

Ok I cannot remember the details on this but on some servers you can use

$var instead of $_GET['var'] to access a variable in the URL, I know this is BAD but I can't remember why it is bad?

Answer 1

I think you mean Register Globals.

You shouldn’t use them because you cannot distinguish the source of that variable values since they can come from any source of the EGPCS variables (Environment, GET, POST, Cookie, Server).

So if you have a the $var, you cannot say if the value is either from $_ENV['var'], $_GET['var'], $_POST['var'], $_COOKIE['var'] or $_SERVER['var'].

Answer 2

The feature is called Register Globals and it allows people to inject variables into your code. See the documentation for examples; here's one:

<?php
// define $authorized = true only if user is authenticated
if (authenticated_user()) {
    $authorized = true;
}

// Because we didn't first initialize $authorized as false, this might be
// defined through register_globals, like from GET auth.php?authorized=1
// So, anyone can be seen as authenticated!
if ($authorized) {
    include "/highly/sensitive/data.php";
}
?>

Answer 3

You can use that if your server has register_globals set to 1 (or true) on the php.ini file.

At some point, this started to be off by default, and applications started to break, which is a reason why this is a bad practice.

You can see a list of php.ini variables here.

Answer 4

It's also bad because you can confuse yourself with the way that PHP will scope your variables. You may wind up overwriting data if you aren't careful. Also, using $_GET is much clearer as to what you are attempting to accomplish.

Answer 5

Because letting people inject values into arbitrary variables is a very bad thing. You could be storing anything there and they could overwrite some value that compromises your security. Remember to use isset to check that a value has been set before trying to use it.

Answer 6

It's bad because if you're not careful to initialize every variable before you use it (something that PHP won't force you to do), people can easily cause your code to do Very Bad Things with a request as simple as /myapp/index.php?admin_privileges=1.

Answer 7

The setting is called REGISTER_GLOBALS and it was discussed here:

Why is REGISTER_GLOBALS so bad?

Answer 8

If you can do that, then "register_globals" is turned on. This is bad because you won't know where a variable came from, and it mixes your variables with the ones any user can inject via the URL. Read more here: http://www.php.net/manual/en/security.globals.php

Answer 9

Once you get used to using $_POST, $_GET, etc your code's purpose will be easier to read and much, much easier to maintain.

Answer 10

Register globals would work but it's going to go away in a future version of PHP. Not to mention that it really is wrong to have it enabled.

You can use extract() for a more controlled behavior. It will extract the keys from an array (in this case, $_GET) into the local context as variables. You can give them a common prefix so that they don't collide with your existing variables. And you can filter the array beforehand to make sure you're only getting the expected variables.

int extract( $var_array [, $type = EXTR_OVERWRITE [, $prefix  ]] )

Import variables from an array into the current symbol table.