Question

I’m transitioning a huge PHP software from PHP4 to PHP5 and among the many (many) problems I’m facing, the biggest one so far seems to be that the previous programmer just banqueted over the register_globals feature, throwing every now and then some variable without specifying the source and shamelessely hiding warnings and notices under the carpet.

I tried to resolve this issue by creating a function that iterates over an array (passed as an argument) and creates global variables via the “variable variables” feature, and then calling it in every page for $_POST, $_GET and $_SESSION. This is the code:

function fix_global_array($array) {
  foreach($array as $key => $value){
    if(!isset($$key)) {
      global $$key;
      $$key = $value;
    }
  }
}

The problem with this function is that the condition isset($$key) is never true, thus the code inside the brackets is always executed and overrides the previous declarations.

Is there any explanation for this behaviour? I read the PHP documentation where it states that

Please note that variable variables cannot be used with PHP’s Superglobal arrays within functions or class methods.

but I don’t understand if it’s related to my problem or not (to tell the truth, I don’t understand what it means either, I couldn’t find any example).

PS: please, don’t bother telling me that using global variables and/or variable variables is bad programming, I know this only too well by myself, but the other option would be modifying about 2.700 files with a thousand lines of code each line per line, and I’m the only programmer here… But if you know a better solution to get rid of all those “undefined variable” warnings, you can make my day.

PPS: and be patient with my english too ^_^

Answer 1

The reason that isset($$key) is never true, in your given code, is because you call global $$key after the condition-check; the variable isn’t in scope until it’s been registered with global. To fix this, simply move the line to above the if-statement, so you function will look like:

function fix_global_array($array) {
    foreach($array as $key => $value){
        global $$key;
        if(!isset($$key)) {
            $$key = $value;
        }
    }
}

This will work fine when passed an array, even if said array is $_POST or $_GET. The order you pass in the arrays will matter though. If an index/key is defined in $_POST and also in $_GET, and you pass $_POST to the function first – the value from $_GET will not be stored into the variable.

Alternatively, if you want to shy-away from using variable-variables, either for readability issues or simple preference, you can use the $GLOBALS superglobal in the same way:

function fix_global_array($array) {
    foreach($array as $key => $value){
        if(!isset($GLOBALS[$key])) {
            $GLOBALS[$key] = $value;
        }
    }
}

With this method, the variables are still accessible as if they were defined normally. For example:

$data = array('first' => 'one', 'second' => 'two');
fix_global_array($data);
echo $first;    // outputs: one
echo $second;   // outputs: two

This example is suitable for both code-samples above.

Extra-alternatively, you can use PHP’s extract() function. It’s purpose is to do exactly what you’re fix_global_array() method does – and even has a flag to overwrite existing variable values. Example usage:

extract($data);
echo $first; // outputs: one

A warning regarding extract(), which directly applies to this situation, comes from the PHP website:

Do not use extract() on untrusted data, like user input (i.e. $_GET,
$_FILES, etc.). If you do, for example if you want to run old code
that relies on register_globals temporarily, make sure you use one of
the non-overwriting extract_type values such as EXTR_SKIP and be aware
that you should extract in the same order that’s defined in
variables_order within the php.ini.