Setting register_globals to OFF

I installed 0.9.6 and it says, "Configuration warning: ’register_globals is set to ON in your php.ini configuration file’"

My host said register_globals can be set to OFF by adding this line to the .htaccess file...

[tt]php_flag register_globals Off[/tt]

I did this, however I still get the warning message that register_globals is set to ON. Then I uncommented the line in the ht.access file and that didn’t work. Then I renamed the ht.access file to .htaccess and that didn’t work either. What am I doing wrong?

DorianJ:

You’ll probably need to inquire with your host again on this. How these overrides work is completely dependent on the configuration of the server, but it sounds like their original instructions are not working. Some hosts only allow this via php.ini in each directory you want to change the setting for, but without more knowledge of the server environment, I can only guess.

From your manager go to Reports->System Info. The third item down the list is php_info() and beside it you will see a link to view it.
Click on it and look for the field that says "Server API"

If you see a Apache Handler:
Your .htaccess file should work and you may need to check to see if you are allowed to modify your server using .htaccess files. You will need to contact your host for this. If you have a host forum you should search for a solution there.

If you see CGI:
You will not be able to set php directives from the .htaccess file and will need to try using the following to disable register globals:
In your root directory you will need to create a file called php.ini
In this file place the following line:


You then need to add a php.ini file with the same in the Manager and Manager>Includes folders and this should do it.

If that doesn’t do it then you will have to contact your host and request that they turn off register globals for your account. If they can’t then you should find another host. Register Globals On is considered a security hole to the point that since PHP 5.0x it has been set to off in the default distro.

Thanks for that thorough answer, Smashingred. My Server API is CGI and I created the three files as you indicated, but it still shows that register_globals is on. I guess this is bad because if I have to ask my host to disable it, then several of my other sites won’t work and I need them to be online ($ reasons).

Just one more check before you contact your Host. Go back to Reports>System Info and recheck the php_info() to see if register globals is showing as off there. If so you may just need to add the php.ini file to more directories under your manager. If it is not, you will have to make the req through your host and have them help you. In the best cases your host should allow local php.ini files to override local settings.

Running PHP this way is a (potentially) more secure method than as an Apache Module based on priveleges and file ownership. Many hosts are moving new servers to running php as a CGI app vs. as apache module in shared environments as it can cut/prevent cross site scripting from the same server.

Let me know how you solve this.

I am going to add a seperate wiki post about how to control register_globals so I want to be even more thorough.

Cheers,

Jay

To give a follow-up on this, my host spent days working on this issue and then finally ’rebuilt’ the server and set the Server API to Apache instead of CGI. Now everything is controlled with .htacess. I don’t know if it’s better to have PHP running as a CGI or Apache module.

While your host is really responsive the advantage of PHP running as a CGI application vs Apache Module is that it reduces the ability to cross site scripting (XSS) as the file ownership is given to the user vs as nobody (anyone who is on the server). That being said if it is set up correctly the server should be no more or less secure if you use and write secure applications.