register_globals Risk & Legacy Code
debt(d8/e8/b7/t8)
Closest to 'silent in production until users hit it' (d9), but semgrep patterns can catch bare $var usage without $_GET/$_POST prefix, so slightly better at d8. Authentication bypasses from uninitialized variables are silent until exploited.
Closest to 'cross-cutting refactor across the codebase' (e7), bumped to e8 because per quick_fix every variable in every script must be audited for explicit superglobal assignment — this touches every input path in the legacy codebase.
Closest to 'strong gravitational pull' (b7) — register_globals-era assumptions shape every script's input handling, and per common_mistakes you cannot safely mix legacy and modern code, forcing the architecture's hand.
Closest to 'serious trap' (t7), bumped to t8 because the misconception is catastrophic: developers assume disabling register_globals fixes the vulnerability, but uninitialized auth variables silently become null and bypass checks — the 'obvious' remediation makes things exploitable rather than safe.
TL;DR
Explanation
register_globals (PHP 3–5.3) turned all GET/POST/COOKIE/SESSION parameters into global variables. $username was automatically set from GET username=admin. This allowed attackers to inject arbitrary variables into scripts. Example: if ($authenticated) { ... } could be bypassed by passing ?authenticated=1. Removed in PHP 5.4. Legacy codebases still using it are critically vulnerable. Identifying it: look for variables used without explicit $_GET/$_POST/$_SERVER assignment. The fix is not just disabling register_globals but auditing every variable for explicit initialisation.
Common Misconception
Why It Matters
Common Mistakes
- Assuming old code is safe because register_globals is now off — uninitialized variables just become null, changing behaviour.
- Not auditing all variables for explicit source.
- Mixing register_globals-era code with modern code without a full rewrite.
Code Examples
<?php
// Legacy: relies on register_globals
// ?authenticated=1 bypasses this:
if ($authenticated) {
echo "Welcome, $username";
}<?php
// Explicit: always initialise from $_SESSION
$authenticated = (bool)($_SESSION['user_id'] ?? false);
$username = htmlspecialchars($_SESSION['username'] ?? '');
if ($authenticated) {
echo "Welcome, " . $username;
}