Question

I am working on a old code base, where programmers assumed that register_globals will always be on. Hence variables are used without $_GET or $_POST prefix, pretty much in every page (the code base is huge, hundreds of scripts). I tried turning it off, but the very first script (login script) goes on an infinite loop.

I understand that going through one script at a time, and one line at a time and fixing the variables is probably the only option (adding the prefix $_GET or $_POST as the case may be). Has anyone does this before? How did you go about doing it? Any advice?

Answer 1

This may result in more damage than good but:

1. Grep out the name="foo" elements from forms into a CSV or line seperated list something and get the action attribute (only if it relates to an actual script)
2. go through the CSV or line-separated list and do a find and replace using sed to replace $currentval with $_POST[‘currentval’]/$_GET[‘currentval’] or $_REQUEST[‘currentval’] (but beware cookies)

for example:

grep -o -E "(action|name)=\"[a-zA-Z0-9_]+\"" formfile.php | sed -E "s/.*\"([a-zA-Z0-9_]+)\"/\\1/" > vars.list

Will give you a line separated list of posted variables (ish) which you can loop through in a bash script or something to replace the vars.

EDIT

If you want to turn register globals on for one site. Add to your .htaccess or Apache config:

php_value register_globals "On"