Tearing my hair out! WTF is php doing?

wh33t · 06-28-2014, 06:41 PM

Hey all,

I just encounter some very strange behaviour on my webserver which runs PHP and Apache.

For some reason when viewing this script such as test.php?year=something

The following:

PHP Code:



<?
echo '$year= ' . $year;
?>

Will actually output

Code:

$year=something

Somehow it's automatically assigning $_GET variables as standard variables. Is this a feature or something that is turned on or off via a configuration?

I'll also add, I'm not including or source any additional scripts off the server.

astrogeek · 06-28-2014, 06:46 PM

What version of php/apache?

Older php would do that if REGISTER_GLOBALS was enabled - now deprecated or removed in latest php.

Also, it is not really clear from your post if there is any other wrapper code or preceeding code before the echo.

It isn't really strange, but more common for older php and always configurable.

wh33t · 06-28-2014, 06:55 PM

Ahh yes, I just researched it further and concluded it was exactly what you said it was.

I'm not including any other code. It doesn't appear as though I can turn off the register_globals with ini_set either.

Thanks for chiming in.

astrogeek · 06-28-2014, 06:57 PM

Quote:

Originally Posted by wh33t

This appears to happen because of register_globals.

Strange, I don't ever recall having to deal with this issue before. I wonder if my host just updated the php settings for the server.

Recent php versions do not include register_globals (major security problem) and it was off by default for a few years before that...

Again, what version of php/apache is this?

sneakyimp · 07-03-2014, 05:06 PM

You cannot turn off register_globals within your script because it has already happened by the time your script begins. You *could* write a loop that unsets any vars which may have been set via register_globals. Something like this would have to run before anything else in your script or you might risk destroying variables that you have actually bothered to define:

Code:

foreach($request as $key => $var) {
  if (isset $$key) {
    unset($$key);
  }
}

jpollard · 07-06-2014, 06:07 AM

Quote:

Originally Posted by wh33t

Hey all,

I just encounter some very strange behaviour on my webserver which runs PHP and Apache.

For some reason when viewing this script such as test.php?year=something

The following:

PHP Code:



<? 
echo '$year= ' . $year; 
?>

Will actually output

Code:

$year=something

Somehow it's automatically assigning $_GET variables as standard variables. Is this a feature or something that is turned on or off via a configuration?

I'll also add, I'm not including or source any additional scripts off the server.

Try changing to:

PHP Code:



<?php 
echo '$year= ' . $year; 
?>

I think the Apache server changed the default to require the "php" spec rather than assuming it would be PHP.