# [PATCH] Fix for bug #31440 (GLOBALS can be by G/P/C when register_globals=On)

- Thread: https://externals.io/message/14971
- Original archive: https://news-web.php.net/php.internals/14971
- Started by Jani Taskinen on 2005-02-15T11:39:04+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #14971 — Jani Taskinen — 2005-02-15T11:39:04+00:00

URL: https://externals.io/message/14971#14971

Patch to fix is here:

         http://www.php.net/~jani/patches/bug31440.php_4_3_patch
         http://www.php.net/~jani/patches/bug31440.php_HEAD_patch

     In PHP_4_3 you can overwrite GLOBALS with these queries:

        ?GLOBALS[foo]=err or ?GLOBALS[]=foo or ?GLOBALS=foo

     In HEAD you can overwrite GLOBALS with this only:

        ?GLOBALS=foo

     I didn't investigate WHY that is the only type of query that
     "works" in HEAD branch but the same patch fixed that too.

     None of super-globals can be overwritten like this, be it
     register_globals On or Off.

     IMNSHO, GLOBALS should be "protected".
     (I don't say that this hacky patch of mine is the way, but it does the job :)

     --Jani

---

## #14987 — Andi Gutmans — 2005-02-15T21:03:01+00:00

URL: https://externals.io/message/14971#14987 · In reply to: #14971

Jani,

Thanks for bringing this up. Will look into this.

Andi

At 01:39 PM 2/15/2005 +0200, Jani Taskinen wrote:

>     Patch to fix is here:
>
>         http://www.php.net/~jani/patches/bug31440.php_4_3_patch
>         http://www.php.net/~jani/patches/bug31440.php_HEAD_patch
>
>     In PHP_4_3 you can overwrite GLOBALS with these queries:
>
>        ?GLOBALS[foo]=err or ?GLOBALS[]=foo or ?GLOBALS=foo
>
>     In HEAD you can overwrite GLOBALS with this only:
>
>        ?GLOBALS=foo
>
>     I didn't investigate WHY that is the only type of query that
>     "works" in HEAD branch but the same patch fixed that too.
>
>     None of super-globals can be overwritten like this, be it
>     register_globals On or Off.
>
>     IMNSHO, GLOBALS should be "protected".
>     (I don't say that this hacky patch of mine is the way, but it does 
> the job :)
>
>     --Jani

---

## #14993 — Andi Gutmans — 2005-02-15T22:27:03+00:00

URL: https://externals.io/message/14971#14993 · In reply to: #14971

This behavior makes some sort of sense. It happens when register_globals is 
on which means you are supposed to be able to access $GLOBALS[] and it 
makes sense for it to stay in sync with the global variables.
Maybe $GLOBALS[] and $GLOBALS direct access are edge cases but should we 
invest time and code to resolve this when we know it's a general problem 
anyway?

Andi

At 01:39 PM 2/15/2005 +0200, Jani Taskinen wrote:

>     Patch to fix is here:
>
>         http://www.php.net/~jani/patches/bug31440.php_4_3_patch
>         http://www.php.net/~jani/patches/bug31440.php_HEAD_patch
>
>     In PHP_4_3 you can overwrite GLOBALS with these queries:
>
>        ?GLOBALS[foo]=err or ?GLOBALS[]=foo or ?GLOBALS=foo
>
>     In HEAD you can overwrite GLOBALS with this only:
>
>        ?GLOBALS=foo
>
>     I didn't investigate WHY that is the only type of query that
>     "works" in HEAD branch but the same patch fixed that too.
>
>     None of super-globals can be overwritten like this, be it
>     register_globals On or Off.
>
>     IMNSHO, GLOBALS should be "protected".
>     (I don't say that this hacky patch of mine is the way, but it does 
> the job :)
>
>     --Jani