HOW TO; register_globals off with shared hosting (1&1)

I see that there is quite a few threads regarding the php configuration of register_globals on shared hosts. I replied to one, but then also decided to post a new thread in order to hopefully answer this question for everyone. (and if you disagree or have more to add, post up!).

Per my understanding of php and apache documentation, a 500 server error is the result of trying to use a .htaccess file on apache2. Therefore, a .htaccess will not work for most.

Most likely, however, you can override server defaults with a php.ini file in the directory you wish to change settings for.

For example, with the host I use (1&1), I place a php.ini file in the root directory of my sites, and also in the manager directory.

The exact php.ini file that I use can be located on the php.net website: http://cvs.php.net/viewvc.cgi/php4.fubar/php.ini-recommended

More information relevant to php.ini here: http://www.washington.edu/computing/web/publishing/php-ini.html#basics

This fix seems to work for me, and the php.ini file is written by those who really know what they’re doing.

Hope this saves everyone some time. (and from being hacked!)

A 500 server error is from having an unsupported .htaccess directive in the file, not for using .htaccess files. I run Apache 2 locally (on MAMP) and on various servers and htaccess files work fine.

The most likely culprit would be the zlib lines as some webhosts do not install or disable the zlib module (don’t ask me why...)

Before I came across ModX last night I had been playing around with Joomla, and spent a lot of time messing around with the Register Globals thing.

Placing a php.ini file in a directory is one solution (though it has to be in EVERY directory in order to be secure). The other solution which works with 1and1 is to add this line at the top of you .htaccess file;

AddType x-mapp-php5 .php

This will execute the PHP in PHP5 mode, which by default has the register_globals flag set to off.

Hope this helps.