Question

HI all

Running PHP Version 5.2.11 and we’ve been given a site which we’re told was running on an earlier version (4 possibly).

We’ve an odd problem where several pages which have a bunch of forms which update the MySql are not working. The problem is where the variables used in the update script are not being defined anywhere in the php before hand. eg.

UPDATE users SET FirstName='$form_firstname'WHERE UserID='$id'"

Now if we change it to..

$form_firstname = $_POST['form_firstname'];
UPDATE users SET FirstName='$form_firstname'WHERE UserID='$id'"

then the update works. We could do this for every single variable defined in every update statement but I’m thinking that seen as this must have worked previously we’re looking at some deprecated code somewhere that forms these variables. I’ve looked for any

import_request_variables

statements but nada.

Can anyone think of anything that would be turned off by default in a new server that would cause this or does this variable have to be declared somewhere?

Cheers muchly

Answer 1

This is register_globals. DO NOT use this; it is a gaping security hole.