register_globals Era & Why It Was Dangerous

TL;DR

Explanation

register_globals was on by default in PHP 3 and PHP 4.0-4.1. PHP 4.2 (2002) turned it off by default — a turning point for PHP security. Before that: every GET/POST/COOKIE param became a global. Millions of PHP apps had auth bypass vulnerabilities. The history: PHP was designed for small scripts, security was an afterthought. The shift to off-by-default caused enormous backlash (many apps broke) but was essential. register_globals was deprecated in PHP 5.3 and removed in PHP 5.4. It's the single biggest security mistake in PHP's history.

Common Misconception

Why It Matters

Common Mistakes

• Not auditing inherited legacy code for register_globals assumptions.
• Assuming all PHP before 5.4 is safe if register_globals was off — other security issues remained.

Code Examples

// PHP with register_globals=On:
// URL: ?admin=1 sets $admin=1
if ($admin) {
    echo 'Welcome, administrator'; // Auth bypass!
}

// Modern: always explicit:
$isAdmin = (bool)($_SESSION['is_admin'] ?? false);
if ($isAdmin) {
    echo 'Welcome, administrator';
}

References

• ↗ https://www.php.net/manual/en/security.globals.php

Tags

Related Terms