register_globals (Legacy Audit)

Also Known As

TL;DR

Explanation

register_globals, deprecated in PHP 5.3 and removed in PHP 5.4, caused all GET, POST, and COOKIE parameters to be injected as global variables. This meant a URL like ?isAdmin=1 would set $isAdmin = true in any script, trivially bypassing authentication. The setting is long removed, but legacy codebases running on outdated PHP versions or those migrated from old code may still contain logic that assumed register_globals behaviour. When auditing legacy PHP, check for uninitialised variable usage and assume any global variable may be attacker-controlled.

Common Misconception

Why It Matters

Common Mistakes

• Legacy code that relied on register_globals and was 'fixed' by adding extract($_REQUEST) — same vulnerability.
• Not auditing old codebases for implicit reliance on register_globals before upgrading PHP.
• Using extract() on user input as a compatibility shim — replicates the vulnerability exactly.
• Not understanding that modern code using proper $_GET/$_POST access is the secure replacement.

Code Examples

// register_globals equivalent — extract() on user input:
extract($_REQUEST); // ?admin=1 creates $admin = '1'
if ($admin) grantAccess(); // Bypassed via URL parameter

// Safe equivalent:
$admin = $_SESSION['is_admin'] ?? false; // Server-controlled, not user-supplied

; register_globals removed in PHP 5.4 — but know what it did:
; GET ?admin=1 would automatically create \$admin = 1
; This was a catastrophic security hole

; Modern PHP — always read from superglobals explicitly:
\$admin = (int)    (\$_GET['admin']  ?? 0);
\$name  = trim(    \$_POST['name']   ?? '');
\$token = (string) (\$_COOKIE['tok'] ?? '');

; Validate every superglobal value — never trust raw input:
\$id = filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT);
if (!\$id) abort(400);

References

• ↗ https://www.php.net/manual/en/security.globals.php

Tags

Related Terms